Splunk Search

I need help working with a Lookup Table...

TorbinIT
Path Finder

Hello again!

I'm working with two different sources of data both tracking the same thing but coming from different sources. I need to consolidate them into one single Splunk search, so I decided to turn one of the two sources of data into a lookup table for the other.

Right now the lookup table I'm using has 3 Fields in it: HostName, Domain, and Tanium.

What I'd like to do is load the 3 fields from this Lookup into my Splunk Search so that:

1) the HostName field from the lookup is merged with the HostName field in the search, with unique HostName values from the search and the lookup both available in the final output, but also that if there's duplicate values for HostName, they're merged together.

2) The Domain and Tanium values from the Lookup are loaded into their corresponding entries in the final output.

Is this possible? I believe it should be if I use the command:

| lookup WinrarTaniumLookup.csv HostName OUTPUT Tanium Domain

But when I put in that command it doesn't appear to be adding any unique HostName values from the Lookup, just merging the HostName values that both the lookup and the search share. 

What am I doing wrong here?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<search>
| append
  [| inputlookup WinrarTaniumLookup.csv]
| stats values(*) as * by HostName

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<search>
| append
  [| inputlookup WinrarTaniumLookup.csv]
| stats values(*) as * by HostName

TorbinIT
Path Finder

That worked, thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...