Splunk Search

Lookups excluding answers if multiple same lines are found

robertlynch2020
Influencer

I have a lookup that end users can update. However they might make a mistake and put in the same data twice.
The issues is, if this is done SPLUNK wont return ether results. So the data is lost as i am using this with a transform.

Initial Search .....| lookup lookup Context_Command AS "Context+Command" OUTPUT Tags CC_Description Threshold

So Example 1 - Working
This is the look up table - I get 10 Row returned to me [As i should] It finds a match for NULL#Login and this is good
Context_Command CC_Description Tags Alert Threshold
NULL#Login TEST2 TEST2 y 5

Example 2 - Not Working
This is the look up table - I get 8 Row returned to me and NULL#Login is excluded from this
Context_Command CC_Description Tags Alert Threshold
NULL#Login TEST2 TEST2 y 5
NULL#Login TEST2 TEST2 y 5

I know this is a human problem, however this file can have hundreds is not thousands of line and this will become difficult to manage.

This is the transform i am using
[Context_Command_lookup]
filename = TEST_MXTIMING.csv
match_type = WILDCARD(Context_Command)

0 Karma
1 Solution

DalJeanis
Legend

One trivial solution is to periodically run...

| inputlookup mylookupname | dedup mykey |outputlookup mylookupname

However, lookup should return the first answer found if there are duplicates.

View solution in original post

0 Karma

DalJeanis
Legend

One trivial solution is to periodically run...

| inputlookup mylookupname | dedup mykey |outputlookup mylookupname

However, lookup should return the first answer found if there are duplicates.

0 Karma

robertlynch2020
Influencer

Hi

Thanks for this.

I think it must be a bug if this is that case.
I will report it so

Thanks
Robert Lynch

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...