How to match two lookups in Splunk?

[joachimroshan]

I have fields ComponentName, CNC in lookup A and fields ComponentName, ENDPOINT in lookup B. The output should have fields ComponentName,CNC,ENDPOINT. My criteria is that if the field ComponentName in both the lookups matches, the output should be displayed. Note-The field CNC in lookup A has its each of its value dependent upon the values of the field ComponentName in lookup A.

[deepashri_123]

Can you try this query;
| inputlookup A | inputlookup append=t B | stats values(CNC) AS CNC values(ENDPOINT) AS ENDPOINT by ComponentName | search CNC=* AND ENDPOINT=*

Let me know if this helps!!

[richgalloway]

Try this (untested) query.

index=foo | lookup A componentName OUTPUT CNC | lookup B componentName OUTPUT ENDPOINT | table componentName CNC ENDPOINT