Splunk Search
Highlighted

How to write a search to append multiple lookups?

SplunkTrust
SplunkTrust

Hi All,

I am trying to write a search that appends multiple lookups. I have 4 lookups in a .CSV format that table a list of customers by channel (4 different channels) that have been migrated from one system to another. I want to create a search that uses all lookups to verify customers that have been migrated are logging in Splunk. If they are not logging, there is some issue that needs to be looked at.

Here is a basic search I am using with one of the lookups:

index=contractgateway earliest=@d sourcetype=esbaudit bpbpname=Invoice
| stats earliest(time) as firstseen, latest(time) as lastseen by customer| append [ |inputlookup edimigratedcustomerlookup.csv ]
| stats min(first
seen) as firstseen, max(lastseen) as lastseen by customer
| outputlookup edi
migratedcustomerlookup.csv

The issue I am having is that no matter which of the four lookups I use, the number events in Splunk remains the same, concluding that my search must be jacked/ I am not using the inputlookup/outputlook commands correctly.

What I eventually would like to do is display a summary page that monitors the customer migration, and table Total Customer Count, Success Rate, Error Rate, No Transaction Rate by each channel.

Any insights on my query would be very helpful.

Thanks in Advance!

Tags (3)
0 Karma
Highlighted

Re: How to write a search to append multiple lookups?

SplunkTrust
SplunkTrust

What are the columns available in lookup tables?

0 Karma
Highlighted

Re: How to write a search to append multiple lookups?

SplunkTrust
SplunkTrust

Only "customer" at the moment. Each lookup, like edimigratedcustomer_lookup.csv, contains a list of customers that have been migrated. So every week I will beupdating the lookups as customers are migrated.

0 Karma
Highlighted

Re: How to write a search to append multiple lookups?

SplunkTrust
SplunkTrust

Give this a try. I

index=contract_gateway earliest=@d sourcetype=esb_audit bp_bp_name=Invoice | stats earliest(_time) as first_seen, latest(_time) as last_seen by customer| append [ |inputlookup edi_migrated_customer_lookup.csv ] | dedup customer first_seen last_seen| outputlookup edi_migrated_customer_lookup.csv
0 Karma
Highlighted

Re: How to write a search to append multiple lookups?

SplunkTrust
SplunkTrust

Thanks for your response. The results are similar where no matter which migrated list I change to the number of events are still the same for all lookups. The lookups range from 300 customers in one, to almost 20,000 in another, so I suspect the number of events to change by each lookup

0 Karma