Splunk Search

Merge two search results and add difference

malekseev
New Member

I have result of one search1 stored in csv by outpootlookup.
I use this lookup for the search2 as a criteria, e.g. what I need to find in search2.
My search

index="index1" source="source1" 
| lookup t.csv A OUTPUT A 
| stats count by A 
| rename A as A4, count as C4 
| table A4,C4
| sort A4
| appendcols 
    [| inputlookup t.csv 
    | table A,C
    | sort A]   

And the result looks like this:
alt text

Columns A,C - columns from criteria
Columns A4,C4 - columns from search

In the end I want to get table with columns:
A, C4
alt text
It means that in table colunms with names(column A) and count(column C4). But there is one condition: if one of A haven't been found in search, then use 0 as count for this line (I marked this cell by yellow color)

P.S. I've tried to do this by join but I always get result without cell bla3

0 Karma

vidhyaArumalla
Path Finder

Please try the below solution.

| inputlookup t.csv 
| table A,C 
| join A type=left 
    [ index="index1" source="source1" 
    | lookup t.csv A OUTPUT A "]
    | stats count(index) as C4 by A
    | sort A
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...