Splunk Search

Pulling two inputlookups (csv files) and graphing their information

lehrfeld
Path Finder

Hi All - I am trying to do some simple reporting on two lookup files we have.

Lookup File A

time number
2015-01-16 100
2015-01-17 200
2015-01-18 300
2015-01-18 600
2015-01-18 700

Lookup File B
time count
2015-01-16 700
2015-01-17 800
2015-01-18 900
2015-01-18 200
2015-01-18 300

I would like to sum(count) by time and sum(number) by time then produce a line chart. But I can't figure out how to use both of the lookup tables.

My last iteration looked like this.

| inputlookup email_into_edge.csv |
appendcols [| inputlookup email_into_forefront.csv
| stats sum(count) AS into_forefront by time]
| stats sum(number) AS into_edge by time

Thanks for any tips, Mike

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

| inputlookup email_into_edge.csv | stats sum(number) AS into_edge by time
| appendcols [| inputlookup email_into_forefront.csv | stats sum(count) AS into_forefront by time] 
 | stats sum(*) as * by time

View solution in original post

somesoni2
Revered Legend

Give this a try

| inputlookup email_into_edge.csv | stats sum(number) AS into_edge by time
| appendcols [| inputlookup email_into_forefront.csv | stats sum(count) AS into_forefront by time] 
 | stats sum(*) as * by time

lehrfeld
Path Finder

Thanks for the reply.... for some reason I was getting weird results. The summing was off... so I did a join on time and that did it.

| inputlookup email_into_forefront.csv
| stats sum(count) AS into_forefront
by time | join time [| inputlookup
email_into_edge.csv | stats
sum(number) AS into_edge by time ]

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...