Splunk Search

How to extract one filed from two lookups with same fields?

MeMilo09
Path Finder

Hey There, 

I have two lookups, both have same exact fields. I need all the fields from Lookup1.csv, which I have no problem getting and only one filed from Lookup2.csv. The only field I need from Lookup2.csv is Lookup_Demand_X, which I created an eval for - gave it the name Demand_X, since lookups use same field names I wanted to differentiate.

The issue I have is that I only need one column from Lookup2.csv - (Demand_X) and the rest of the data only pertaining to Lookup1.csv.  When I bring in the column for Demand_X from Lookup1.csv I consequently bring the all the data for Lookup1. csv. 

 

How can I only keep the data from Lookup1.csv and only bring in just one field from Lookup2.csv (Demand_X)? 


 

| inputlookup Lookup1.csv | inputlookup append=t Lookup2.csv | eval Demand_X=case(lookup_Demand_Team="Red", lookup_Demand_X), Demand_Y=case(lookup_Demand_Team="Blue",lookup_Demand_Y) | stats values(Demand_X) as Demand_X, values(Demand_Y) as Demand_Y values(lookup_Demand_Team) as lookup_Demand_Team, values(lookup_Grouping) as lookup_Grouping, values(lookup_desc) as lookup_desc, values(lookup_Sub) as lookup_Sub values(lookup_Service) as lookup_Service values(lookup_Type) as lookup_Type count(lookup_Count) as lookup_Count by lookup_Z_Field  | where isNotNull(Demand_Y)

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...