How to write a search to append multiple lookups?

[_gkollias]

Hi All,

I am trying to write a search that appends multiple lookups. I have 4 lookups in a .CSV format that table a list of customers by channel (4 different channels) that have been migrated from one system to another. I want to create a search that uses all lookups to verify customers that have been migrated are logging in Splunk. If they are not logging, there is some issue that needs to be looked at.

Here is a basic search I am using with one of the lookups:

index=contract_gateway earliest=@d sourcetype=esb_audit bp_bp_name=Invoice
| stats earliest(_time) as first_seen, latest(_time) as last_seen by customer| append [ |inputlookup edi_migrated_customer_lookup.csv ]
| stats min(first_seen) as first_seen, max(last_seen) as last_seen by customer
| outputlookup edi_migrated_customer_lookup.csv

The issue I am having is that no matter which of the four lookups I use, the number events in Splunk remains the same, concluding that my search must be jacked/ I am not using the inputlookup/outputlook commands correctly.

What I eventually would like to do is display a summary page that monitors the customer migration, and table Total Customer Count, Success Rate, Error Rate, No Transaction Rate by each channel.

Any insights on my query would be very helpful.

Thanks in Advance!

[somesoni2]

Give this a try. I

index=contract_gateway earliest=@d sourcetype=esb_audit bp_bp_name=Invoice | stats earliest(_time) as first_seen, latest(_time) as last_seen by customer| append [ |inputlookup edi_migrated_customer_lookup.csv ] | dedup customer first_seen last_seen| outputlookup edi_migrated_customer_lookup.csv

[_gkollias]

Thanks for your response. The results are similar where no matter which migrated list I change to the number of events are still the same for all lookups. The lookups range from 300 customers in one, to almost 20,000 in another, so I suspect the number of events to change by each lookup

[_gkollias]

Only "customer" at the moment. Each lookup, like edi_migrated_customer_lookup.csv, contains a list of customers that have been migrated. So every week I will beupdating the lookups as customers are migrated.

[somesoni2]

What are the columns available in lookup tables?