Splunk Search

Match values under 2 different fields

linwqg
New Member

Need help. Appreciate in advance.

I have 2 lookup csv. I need to match each value under "numberX" field against the list of values under "numnberY" field. If there is a match, e.g. 4653, to obtain the following output.

alt text

Tags (1)
0 Karma
1 Solution

niketn
Legend

@linwqg, try the following search

| inputlookup csv1.csv where 
    [| inputlookup csv2.csv 
    | rename numberY as numberX 
    | table numberX]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@linwqg, try the following search

| inputlookup csv1.csv where 
    [| inputlookup csv2.csv 
    | rename numberY as numberX 
    | table numberX]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

linwqg
New Member

Thanks niketnilay. Will give it a try too.

0 Karma

linwqg
New Member

Your approach work as well. Thanks niketnilay.

0 Karma

niketn
Legend

@linwqg, please accept the answer if your issue is resolved to mark this question as answered 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

HiroshiSatoh
Champion

Try this!

|inputlookup csv1|search [search |inputlookup csv2|rename numberY AS numberX |table numberX ]
|table numberX, info, more_info
OR
|inputlookup csv1|join type=inner numberX AS numberY [search |inputlookup csv2]
|table numberX, info, more_info
0 Karma

linwqg
New Member

Many thanks. Will definitely give this a try as well.

0 Karma

linwqg
New Member

I understand from the first pipe onward, that we are renaming the field and table it out.

Why is this important? How to interpret the search before all these?

search |inputlookup csv2|rename numberY AS numberX |table numberX

0 Karma

HiroshiSatoh
Champion

|search [search |inputlookup csv2|rename numberY AS numberX |table numberX]

search (numberX="X" OR numberX="Y" OR numberX="Z")

0 Karma

linwqg
New Member

What's the different between 1 and 2?

  1. |inputlookup csv1|search [search |inputlookup csv2|rename numberY AS numberX |table numberX ]
  2. |inputlookup csv1|search [|inputlookup csv2|rename numberY AS numberX |table numberX ]
0 Karma

p_gurav
Champion

Hi,

try something like this:

|inputlookup csv2|lookup csv1 numberX AS numberY OUTPUTNEW info,more_info|table numberX, info, more_info
0 Karma

linwqg
New Member

Thanks for the headstart.

Tried but it does not seem to work.

0 Karma

linwqg
New Member

I did abit of cleanup and i think it works. Thanks p_gurav.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...