Splunk Search

How to display search with multiple lookup? [SOLVED]

brad_
Engager

Hello
I have several lookups and I would like to display the details on a date range but I can't really do it
I have tried several combinations but either I display the last one or I display too many elements
As a bonus if I could have the total it would be cool

 

 

| inputlookup file1.csv
| append
    [| inputlookup file2.csv]
| append
    [| inputlookup file3.csv]
| append
    [| inputlookup file4.csv]
| append
    [| inputlookup file5.csv]
| append
    [| inputlookup file6.csv]
| sort - _time
| eval date = strftime(_time,"%Y-%m-%d")
| search date>2022-07-01 AND date<2022-07-04
| transpose 6
| sort - column
| search column=date OR column=count
| fields - column
| rename "row 1" as "name1", "row 2" as "name2", "row 3" as "name3", "row 4" as "name4", "row 5" as "name5", "row 6" as "name6"

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup file1.csv
| rename count as file1
| append
    [| inputlookup file2.csv
    | rename count as file2]
| append
    [| inputlookup file3.csv
    | rename count as file3]
| append
    [| inputlookup file4.csv
    | rename count as file4]
| append
    [| inputlookup file5.csv
    | rename count as file5]
| append
    [| inputlookup file6.csv
    | rename count as file6]
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_time

View solution in original post

brad_
Engager

Thx for your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve - can you share some of the events (contents of csv files) and what your expected output would be

Having said that, you might want to use where command rather than search and use unformatted epoch times

| where _time > strptime("2022-07-01","%Y-%m-%d") AND _time < strptime("2022-07-04","%Y-%m-%d")
| transpose 6
| sort - column
| where column="_time" OR column="count"
0 Karma

brad_
Engager

Hello sorry to be unclear
all lookup have the same model see below

lookup.PNG
I need to display the items per line for each date of the range see the result file

Datefile1file2file3file4file5file
04/07/202223523536645545683
05/07/2022210300125120111513
06/07/2022185365116194682657
07/07/20221604303572692567127
08/07/202213549559834382108198
Total 9251825156297340272478


I hope that it is clearer
Thx

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup file1.csv
| rename count as file1
| append
    [| inputlookup file2.csv
    | rename count as file2]
| append
    [| inputlookup file3.csv
    | rename count as file3]
| append
    [| inputlookup file4.csv
    | rename count as file4]
| append
    [| inputlookup file5.csv
    | rename count as file5]
| append
    [| inputlookup file6.csv
    | rename count as file6]
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_time
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...