Splunk Search

How to display search with multiple lookup? [SOLVED]

brad_
Engager

Hello
I have several lookups and I would like to display the details on a date range but I can't really do it
I have tried several combinations but either I display the last one or I display too many elements
As a bonus if I could have the total it would be cool

 

 

| inputlookup file1.csv
| append
    [| inputlookup file2.csv]
| append
    [| inputlookup file3.csv]
| append
    [| inputlookup file4.csv]
| append
    [| inputlookup file5.csv]
| append
    [| inputlookup file6.csv]
| sort - _time
| eval date = strftime(_time,"%Y-%m-%d")
| search date>2022-07-01 AND date<2022-07-04
| transpose 6
| sort - column
| search column=date OR column=count
| fields - column
| rename "row 1" as "name1", "row 2" as "name2", "row 3" as "name3", "row 4" as "name4", "row 5" as "name5", "row 6" as "name6"

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup file1.csv
| rename count as file1
| append
    [| inputlookup file2.csv
    | rename count as file2]
| append
    [| inputlookup file3.csv
    | rename count as file3]
| append
    [| inputlookup file4.csv
    | rename count as file4]
| append
    [| inputlookup file5.csv
    | rename count as file5]
| append
    [| inputlookup file6.csv
    | rename count as file6]
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_time

View solution in original post

brad_
Engager

Thx for your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve - can you share some of the events (contents of csv files) and what your expected output would be

Having said that, you might want to use where command rather than search and use unformatted epoch times

| where _time > strptime("2022-07-01","%Y-%m-%d") AND _time < strptime("2022-07-04","%Y-%m-%d")
| transpose 6
| sort - column
| where column="_time" OR column="count"
0 Karma

brad_
Engager

Hello sorry to be unclear
all lookup have the same model see below

lookup.PNG
I need to display the items per line for each date of the range see the result file

Datefile1file2file3file4file5file
04/07/202223523536645545683
05/07/2022210300125120111513
06/07/2022185365116194682657
07/07/20221604303572692567127
08/07/202213549559834382108198
Total 9251825156297340272478


I hope that it is clearer
Thx

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup file1.csv
| rename count as file1
| append
    [| inputlookup file2.csv
    | rename count as file2]
| append
    [| inputlookup file3.csv
    | rename count as file3]
| append
    [| inputlookup file4.csv
    | rename count as file4]
| append
    [| inputlookup file5.csv
    | rename count as file5]
| append
    [| inputlookup file6.csv
    | rename count as file6]
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_time
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...