I am trying to write a search that appends multiple lookups. I have 4 lookups in a .CSV format that table a list of customers by channel (4 different channels) that have been migrated from one system to another. I want to create a search that uses all lookups to verify customers that have been migrated are logging in Splunk. If they are not logging, there is some issue that needs to be looked at.
Here is a basic search I am using with one of the lookups:
index=contractgateway earliest=@d sourcetype=esbaudit bpbpname=Invoice
| stats earliest(time) as firstseen, latest(time) as lastseen by customer| append [ |inputlookup edimigratedcustomerlookup.csv ]
| stats min(firstseen) as firstseen, max(lastseen) as lastseen by customer
| outputlookup edimigratedcustomerlookup.csv
The issue I am having is that no matter which of the four lookups I use, the number events in Splunk remains the same, concluding that my search must be jacked/ I am not using the inputlookup/outputlook commands correctly.
What I eventually would like to do is display a summary page that monitors the customer migration, and table Total Customer Count, Success Rate, Error Rate, No Transaction Rate by each channel.
Any insights on my query would be very helpful.
Thanks in Advance!
Only "customer" at the moment. Each lookup, like edimigratedcustomer_lookup.csv, contains a list of customers that have been migrated. So every week I will beupdating the lookups as customers are migrated.
Give this a try. I
index=contract_gateway earliest=@d sourcetype=esb_audit bp_bp_name=Invoice | stats earliest(_time) as first_seen, latest(_time) as last_seen by customer| append [ |inputlookup edi_migrated_customer_lookup.csv ] | dedup customer first_seen last_seen| outputlookup edi_migrated_customer_lookup.csv
Thanks for your response. The results are similar where no matter which migrated list I change to the number of events are still the same for all lookups. The lookups range from 300 customers in one, to almost 20,000 in another, so I suspect the number of events to change by each lookup