Multiple values are showing in the single field after joining the lookup.

[LRathinakumar]

Hello Splunkers,

I have two lookups which are need to join. In lookup1.csv its containing the Rule name and the technique id in the columns and in lookup2.csv it contains the technique id and the tactic name in the columns. Now i have joined the two lookups and got the result. Now the problem i am facing is that if the rule is having the multiple tactics name then the output result is displaying them in the same single field (screenshot attached). But i need the result as if the rule is having two tactic names then it should display 2 times the rule name and the tactic names individually.

the query i used to join the lookups is

| inputlookup lookup1.csv | lookup lookup2.csv technique_id

Waiting for the response....

Thanks in advance

[yuanliu]

I suppose you are referring to the row with technique_id T1550.  Maybe lookup2 does contain multiple matches?  What does this search give you?

| makeresults
| fields - _time
| eval technique_id = "T1550"
| lookup lookup2.csv technique_id

If this returns the same two tactic_name, there is no problem with your search.

[LRathinakumar]

Hello @yuanliu 

Thank you for the response...

Yes the lookup2.csv contains the multiple matches. The screenshot attached is the results for that search. In that screenshot you can see that the T1550 is having the two tactic names. So what is need is that the two tactic names should come separately with the rule name and the technique name again.... So how can i get it .....

Thanks i advance...

[yuanliu · Accepted solution]

Maybe your ask is mvexpand?  Not totally sure of your requirement.

| inputlookup lookup1.csv
| lookup lookup2.csv technique_id
| mvexpand tactic_name