Splunk Search

How to lookup against a csv file and join data with a multi-value field?

axdahl
Explorer

I have a lookup file that is basically the following:

userid,group
1,g1
1,g2
1,g3
2,g3
2,g1

I want to do a lookup against this table and return a multivalue field for each event.

i.e. post lookup, if I do table userid, group, I should see:

userid   group
------------------------
1        g1
         g2
         g3
------------------------
2        g1
         g3
------------------------

Basically the lookup should return all matches as a multivalue field. Right now if I'm using

.... | join max=0 userid [inputlookup testgroup.csv ] | table userId group...

But what happens is that each event just gets a single value (g1, g2 or g3) returned for group instead of a multivalued field that contains all matches.

1 Solution

strive
Influencer

Try this

.... | join max=0 userid [|inputlookup testgroup.csv ] | stats values(group) as group by userid

View solution in original post

strive
Influencer

Try this

.... | join max=0 userid [|inputlookup testgroup.csv ] | stats values(group) as group by userid

axdahl
Explorer

that was it!, thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...