Splunk Search

How to extract one filed from two lookups with same fields?

MeMilo09
Path Finder

Hey There, 

I have two lookups, both have same exact fields. I need all the fields from Lookup1.csv, which I have no problem getting and only one filed from Lookup2.csv. The only field I need from Lookup2.csv is Lookup_Demand_X, which I created an eval for - gave it the name Demand_X, since lookups use same field names I wanted to differentiate.

The issue I have is that I only need one column from Lookup2.csv - (Demand_X) and the rest of the data only pertaining to Lookup1.csv.  When I bring in the column for Demand_X from Lookup1.csv I consequently bring the all the data for Lookup1. csv. 

 

How can I only keep the data from Lookup1.csv and only bring in just one field from Lookup2.csv (Demand_X)? 


 

| inputlookup Lookup1.csv | inputlookup append=t Lookup2.csv | eval Demand_X=case(lookup_Demand_Team="Red", lookup_Demand_X), Demand_Y=case(lookup_Demand_Team="Blue",lookup_Demand_Y) | stats values(Demand_X) as Demand_X, values(Demand_Y) as Demand_Y values(lookup_Demand_Team) as lookup_Demand_Team, values(lookup_Grouping) as lookup_Grouping, values(lookup_desc) as lookup_desc, values(lookup_Sub) as lookup_Sub values(lookup_Service) as lookup_Service values(lookup_Type) as lookup_Type count(lookup_Count) as lookup_Count by lookup_Z_Field  | where isNotNull(Demand_Y)

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.