Splunk Search

Join with different field names

jenkinsta
Path Finder

I have an inputlookup called adexport.csv thats big...

trying to join and match two fields in the lookup UserName and with the splunk field UserId.

 

trying but this don't seem to work. Tried a variation of join and append, my splunk foo is dead

index=data
| lookup adexport.csv UserName as UserId OUTPUT UserId Title
| table _time UserId Title

 

 

Labels (2)
0 Karma
1 Solution

jenkinsta
Path Finder

Got it. actually renamed the field in csv and re-uploaded...

join UserId [inputlookup adexport.csv | fields UserId Title ]

why did I complicate things. 

If there is a faster way let me know

View solution in original post

0 Karma

jenkinsta
Path Finder

Got it. actually renamed the field in csv and re-uploaded...

join UserId [inputlookup adexport.csv | fields UserId Title ]

why did I complicate things. 

If there is a faster way let me know

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jenkinsta ,

your solution surely work, but you could also try:

 

index=data
| lookup adexport.csv UserName AS UserId OUTPUT Title
| table _time UserId Title

 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...