Splunk Search

How to write a search to join the data from four lookups on a unique field?

New Member

Hello Experts,

Can you please help me with a search to join these four lookups on login (unique field). Lookups LOOKUP_A.CSV, LOOKUP_B.CSV, LOOKUP_C.CSV need to be joined to MASTER_lookup to form a RESULT_LOOKUP.

Appreciate your help with this.

Please check the source lookups and resultingdesired lookup. (attachment/inline image)

alt text

0 Karma


Another option?

| inputlookup  MASTER_LOOKUP.CSV | inputlookup LOOKUP_A.CSV append=t | inputlookup LOOKUP_B.CSV  append=t | inputlookup LOOKUP_C.CSV  append=t | outputlookup RESULT_LOOKUP.csv
0 Karma


What about this?

| inputcsv MASTER_LOOKUP.csv
| join type=left login [| inputcsv LOOKUP_A.csv]
| join type=left login [| inputcsv LOOKUP_B.csv]
| join type=left login [| inputcsv LOOKUP_C.csv]
| outputcsv RESULT_LOOKUP.csv
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!