Splunk Search

Pulling two inputlookups (csv files) and graphing their information

lehrfeld
Path Finder

Hi All - I am trying to do some simple reporting on two lookup files we have.

Lookup File A

time number
2015-01-16 100
2015-01-17 200
2015-01-18 300
2015-01-18 600
2015-01-18 700

Lookup File B
time count
2015-01-16 700
2015-01-17 800
2015-01-18 900
2015-01-18 200
2015-01-18 300

I would like to sum(count) by time and sum(number) by time then produce a line chart. But I can't figure out how to use both of the lookup tables.

My last iteration looked like this.

| inputlookup email_into_edge.csv |
appendcols [| inputlookup email_into_forefront.csv
| stats sum(count) AS into_forefront by time]
| stats sum(number) AS into_edge by time

Thanks for any tips, Mike

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

| inputlookup email_into_edge.csv | stats sum(number) AS into_edge by time
| appendcols [| inputlookup email_into_forefront.csv | stats sum(count) AS into_forefront by time] 
 | stats sum(*) as * by time

View solution in original post

somesoni2
Revered Legend

Give this a try

| inputlookup email_into_edge.csv | stats sum(number) AS into_edge by time
| appendcols [| inputlookup email_into_forefront.csv | stats sum(count) AS into_forefront by time] 
 | stats sum(*) as * by time

lehrfeld
Path Finder

Thanks for the reply.... for some reason I was getting weird results. The summing was off... so I did a join on time and that did it.

| inputlookup email_into_forefront.csv
| stats sum(count) AS into_forefront
by time | join time [| inputlookup
email_into_edge.csv | stats
sum(number) AS into_edge by time ]

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

PLATFORM TECH TALKS What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Thursday, February 27, ...