Splunk Search

I have two tables "order.csv" and "delivery.csv". How can I use lookup command to check the delivery status based on the product?

Madhan45
Path Finder
  1. delivery.csv contains the fields- key,name,product,price
  2. order.csv contains the fields- key,shipdate,location,delivery_status,price
Tags (2)
0 Karma

woodcock
Esteemed Legend

You can begin a search with a pipe command, but only if that command creates events, which inputlookup does. So a search like this should work:

  | inputlookup delivery.csv | lookup order.csv key OUTPUT delivery_status | where delivery_status="failed"
0 Karma

HeinzWaescher
Motivator

Do you want to have it like this?

 | inputlookup delivery.csv
 | lookup order.csv key OUTPUT delivery_status
0 Karma

Madhan45
Path Finder

I want to find out the "name" where delivery_status is "failed".

Before this command do i need to add index=*?

can u give me a exact command?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...