Splunk Search

How to join two different result sharing common field?

yohhpark
Path Finder

Search 1.

| inputlookup test1.csv

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| table ITEM 1 ITEM3

 

Conclusion.

I want it to show

|table ITEM1 ITEM2 ITEM3

 

but my results are showing

ITEM1 ITEM2

ITEM1 ITEM2

ITEM1               ITEM3

ITEM1               ITEM3

 

 

Question.

How can I join the Item1s? so that I get a result of

ITEM1 ITEM2 ITEM3

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You should show us what is the code that gave you the "wrong" results.

Here is an alternative to @gcusello's:

| inputlookup test1.csv output ITEM1 ITEM2
| lookup test2.csv ITEM1 output ITEM3
| table ITEM 1 ITEM2 ITEM3

Efficiency-wise, use the smaller of the two as test1.csv.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

yohhpark
Path Finder

One problem.

Let say I have a result below

ID         Status       Remark               Values

11         PASS          CHECKED         something something hello

371      FAILED       CONFIRMED    someting hello SOME

 

let say I want to input another field from a inputlookup that is correlated with the ID number.

ex)

| inputlookup test

|table ID ActualName

 

which the results comes out

11       McDonald

371    BurgerKing

 

 

HOW TO simply input that result into the first query so that I can get a result as below?

ID        ActualValue              Status       Remark               Values

11       McDonald                   PASS          CHECKED         something something hello

371      BurgerKing                FAILED       CONFIRMED    someting hello SOME

0 Karma

yohhpark
Path Finder

ITEM1 are the results of eval.

EX)

 

Search 1.

| inputlookup test1.csv

| eval ITEM1(something)

| eval ITEM2(something)

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| eval ITEM1(something)

| eval ITEM3(something)

| table ITEM 1 ITEM3

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...