Splunk Search

How to join two different result sharing common field?

yohhpark
Path Finder

Search 1.

| inputlookup test1.csv

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| table ITEM 1 ITEM3

 

Conclusion.

I want it to show

|table ITEM1 ITEM2 ITEM3

 

but my results are showing

ITEM1 ITEM2

ITEM1 ITEM2

ITEM1               ITEM3

ITEM1               ITEM3

 

 

Question.

How can I join the Item1s? so that I get a result of

ITEM1 ITEM2 ITEM3

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You should show us what is the code that gave you the "wrong" results.

Here is an alternative to @gcusello's:

| inputlookup test1.csv output ITEM1 ITEM2
| lookup test2.csv ITEM1 output ITEM3
| table ITEM 1 ITEM2 ITEM3

Efficiency-wise, use the smaller of the two as test1.csv.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

yohhpark
Path Finder

One problem.

Let say I have a result below

ID         Status       Remark               Values

11         PASS          CHECKED         something something hello

371      FAILED       CONFIRMED    someting hello SOME

 

let say I want to input another field from a inputlookup that is correlated with the ID number.

ex)

| inputlookup test

|table ID ActualName

 

which the results comes out

11       McDonald

371    BurgerKing

 

 

HOW TO simply input that result into the first query so that I can get a result as below?

ID        ActualValue              Status       Remark               Values

11       McDonald                   PASS          CHECKED         something something hello

371      BurgerKing                FAILED       CONFIRMED    someting hello SOME

0 Karma

yohhpark
Path Finder

ITEM1 are the results of eval.

EX)

 

Search 1.

| inputlookup test1.csv

| eval ITEM1(something)

| eval ITEM2(something)

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| eval ITEM1(something)

| eval ITEM3(something)

| table ITEM 1 ITEM3

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...