Splunk Search

How to multisearch using values from more than one lookup?

amitrinx
Explorer

I have two lookups
RLQuotas: Endpoint, Endpoint Name, filter, quota, Window
RLFilters: Attribute, filter

I want to loop through all the endpoints. all endpoints have a specific window, quota and filter and i am searching it based on filter attribute
I want output fields Endpoint Name, filter, Quota

This is the query i came up with

| inputlookup ID-RL-Quotas | lookup ID-RL-Filters Filter | fields Endpoint, "Endpoint Name", Attribute, Window, Quota, Filter | rename "Endpoint Name" as EndpointName
| map [| eval Window = tonumber($Window$) | search sourcetype="some"
http_url = "$Endpoint$"
minutesago=Window
| eval ip = mvindex(split(http_remoteip,","),0)
| eval EndpointName = "$EndpointName$"
| eval WindowI ="$Window$"
| eval QuotaI="$Quota$"
| eval FilterI="$Filter$"
| search $Attribute$ = "*"
| stats values(EndpointName) as "Endpoint Name", values(FilterI) as Filter, values(WindowI) as Window, values(QuotaI) as Quota, count by $Attribute$
| where count >= 0.8 * $Quota$
| sort -count] maxsearches=10000

This only gives me one filter output not all

Labels (1)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, the topic says "multisearch" and you're using map.

Secondly, you don't have any event-generating commands in your map.

Thirdly, most probably this isnot the way to solve your problem.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...