Splunk Search

case-sensitive on subsearch

simo
Path Finder

hi

I have this situation

index="idx" [| inputlookup name.csv | table id name ]

idx=

idname
1a2aaa
1A2aaa
12abbb

 

lookup

idname
1a2

aaa

 

the result is that it extracts the first 2 lines. How do I extract just the first line?

Thank you

Simone

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="idx" 
| where [| inputlookup name.csv | table id name ]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="idx" 
| where [| inputlookup name.csv | table id name ]
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...