Splunk Search

How to extract one filed from two lookups with same fields?

MeMilo09
Path Finder

Hey There, 

I have two lookups, both have same exact fields. I need all the fields from Lookup1.csv, which I have no problem getting and only one filed from Lookup2.csv. The only field I need from Lookup2.csv is Lookup_Demand_X, which I created an eval for - gave it the name Demand_X, since lookups use same field names I wanted to differentiate.

The issue I have is that I only need one column from Lookup2.csv - (Demand_X) and the rest of the data only pertaining to Lookup1.csv.  When I bring in the column for Demand_X from Lookup1.csv I consequently bring the all the data for Lookup1. csv. 

 

How can I only keep the data from Lookup1.csv and only bring in just one field from Lookup2.csv (Demand_X)? 


 

| inputlookup Lookup1.csv | inputlookup append=t Lookup2.csv | eval Demand_X=case(lookup_Demand_Team="Red", lookup_Demand_X), Demand_Y=case(lookup_Demand_Team="Blue",lookup_Demand_Y) | stats values(Demand_X) as Demand_X, values(Demand_Y) as Demand_Y values(lookup_Demand_Team) as lookup_Demand_Team, values(lookup_Grouping) as lookup_Grouping, values(lookup_desc) as lookup_desc, values(lookup_Sub) as lookup_Sub values(lookup_Service) as lookup_Service values(lookup_Type) as lookup_Type count(lookup_Count) as lookup_Count by lookup_Z_Field  | where isNotNull(Demand_Y)

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...