Splunk Search

How to match two lookups in Splunk?

joachimroshan
New Member

I have fields ComponentName, CNC in lookup A and fields ComponentName, ENDPOINT in lookup B. The output should have fields ComponentName,CNC,ENDPOINT. My criteria is that if the field ComponentName in both the lookups matches, the output should be displayed. Note-The field CNC in lookup A has its each of its value dependent upon the values of the field ComponentName in lookup A.

Tags (1)
0 Karma

deepashri_123
Motivator

Can you try this query;
| inputlookup A | inputlookup append=t B | stats values(CNC) AS CNC values(ENDPOINT) AS ENDPOINT by ComponentName | search CNC=* AND ENDPOINT=*

Let me know if this helps!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this (untested) query.

index=foo | lookup A componentName OUTPUT CNC | lookup B componentName OUTPUT ENDPOINT | table componentName CNC ENDPOINT
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...