Splunk Search

Lookup from multiple table

basics
Explorer

Hello,

my goal is to find and combine data from multiple source.

Here:

  • employee_lookup: the table for all employee database
  • product_lookup: the table for all the product 

now my goal is to find, how many company wide product each department uses and group by DepartmentName, ProductName, and Count.

The department name is on the  "employee_lookup" table along with employee name, department name. So when any employee clicks on a product, it is counted as a product use and logs the data into Splunk.

my Splunk query is as follows:

 

data = "global"
|  lookup  product_lookup productID OUTPUT ProductName
|  lookup employee_lookup userID OUTPUT DepartmentName
|  table ProductName, DepartmentName, UserID

that query does not work...

 

My goal is to find the total count of product usages by Department. 

The resulting table should be like:

 

DepartmentName,     Product,     count
--------------------------------------------------
Dept_5,     Product1234,     2000
Dept_5,     Product333,     1434
Dept_5,     Product633,     600
Dept_2,   Product333,     2500
Dept_2,   Product215,     2500
Dept_2,   Product415,     1200
....

so basically group by department, product, count 

any suggestions and recommendation would be very helpful. Thank you!

Labels (7)
0 Karma

basics
Explorer

I had a typo and it works now.

However, couple more questions because I cannot do:

  • Group by DepartmentName, ProductName, Count

how do I do that?

 

0 Karma

to4kawa
Ultra Champion

your query

| stats count by DepartmentName, ProductName


0 Karma

to4kawa
Ultra Champion

If your log has both productID and userID field, your query will run.
If there aren't these, you should provide more details.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...