Splunk Search

How to extract one filed from two lookups with same fields?

MeMilo09
Path Finder

Hey There, 

I have two lookups, both have same exact fields. I need all the fields from Lookup1.csv, which I have no problem getting and only one filed from Lookup2.csv. The only field I need from Lookup2.csv is Lookup_Demand_X, which I created an eval for - gave it the name Demand_X, since lookups use same field names I wanted to differentiate.

The issue I have is that I only need one column from Lookup2.csv - (Demand_X) and the rest of the data only pertaining to Lookup1.csv.  When I bring in the column for Demand_X from Lookup1.csv I consequently bring the all the data for Lookup1. csv. 

 

How can I only keep the data from Lookup1.csv and only bring in just one field from Lookup2.csv (Demand_X)? 


 

| inputlookup Lookup1.csv | inputlookup append=t Lookup2.csv | eval Demand_X=case(lookup_Demand_Team="Red", lookup_Demand_X), Demand_Y=case(lookup_Demand_Team="Blue",lookup_Demand_Y) | stats values(Demand_X) as Demand_X, values(Demand_Y) as Demand_Y values(lookup_Demand_Team) as lookup_Demand_Team, values(lookup_Grouping) as lookup_Grouping, values(lookup_desc) as lookup_desc, values(lookup_Sub) as lookup_Sub values(lookup_Service) as lookup_Service values(lookup_Type) as lookup_Type count(lookup_Count) as lookup_Count by lookup_Z_Field  | where isNotNull(Demand_Y)

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the first lookup as an index into the second.

| inputlookup Lookup1.csv 
| lookup Lookup2.csv lookup_Z_field OUTPUT Demand_X
| ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...