Splunk Search

How to join my search to a lookup table with more than one field?

Path Finder

Hi

I have a search query that I need to join to a lookup table.

I have it joining to this lookup table TestDec14 and working when I look up the NEWID field, but I also need to join to the IDTYPE field

index=test NEWID=123 OR NEWID= 456

| lookup TestDec14 NEWID
| eval new
add=NEWID.",".address

| chart count by new
add
| sort count desc

Is this possible? If so do you have any syntax on how I would do this? I've tried a few options but none have worked

Thanks

Tags (2)
1 Solution

Communicator

Yes you can lookup from multiple fields.

The syntax is:

... | lookup YOUR_LOOKUP field1 fieldn OUTPUT column1 columnn

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

In your example it will be:

index=test NEW_ID=123 OR NEW_ID= 456 
| lookup TestDec14 NEW_ID ID_TYPE OUTPUT
| eval new_add=NEW_ID.",".address 
| chart count by new_add 
| sort count desc

View solution in original post

Communicator

Yes you can lookup from multiple fields.

The syntax is:

... | lookup YOUR_LOOKUP field1 fieldn OUTPUT column1 columnn

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

In your example it will be:

index=test NEW_ID=123 OR NEW_ID= 456 
| lookup TestDec14 NEW_ID ID_TYPE OUTPUT
| eval new_add=NEW_ID.",".address 
| chart count by new_add 
| sort count desc

View solution in original post

Path Finder

Perfect! Thanks (a month after you answered it!!)

0 Karma