I need help working with a Lookup Table...

[TorbinIT]

Hello again!

I'm working with two different sources of data both tracking the same thing but coming from different sources. I need to consolidate them into one single Splunk search, so I decided to turn one of the two sources of data into a lookup table for the other.

Right now the lookup table I'm using has 3 Fields in it: HostName, Domain, and Tanium.

What I'd like to do is load the 3 fields from this Lookup into my Splunk Search so that:

1) the HostName field from the lookup is merged with the HostName field in the search, with unique HostName values from the search and the lookup both available in the final output, but also that if there's duplicate values for HostName, they're merged together.

2) The Domain and Tanium values from the Lookup are loaded into their corresponding entries in the final output.

Is this possible? I believe it should be if I use the command:

| lookup WinrarTaniumLookup.csv HostName OUTPUT Tanium Domain

But when I put in that command it doesn't appear to be adding any unique HostName values from the Lookup, just merging the HostName values that both the lookup and the search share. 

What am I doing wrong here?

[ITWhisperer · Accepted solution]

Try something like this

<search>
| append
  [| inputlookup WinrarTaniumLookup.csv]
| stats values(*) as * by HostName

[TorbinIT]

That worked, thank you!