Splunk Search

concat lookups for a search

rtalcik
Path Finder

so in this search the full list is everything in zone A. do is everything in zone b, zoneserialnumbers are a list of serial numbers.

the goal is to say everything in do is in both zoneserial and fulla_list

| inputlookup fullA_list
| join [ | inputlookup zonesserialnumbers ]
| join SerialNumber type=outer [ | inputlookup do | rename serialNo as SerialNumber ]
| search in_do=yes Location=$location$
| fillnull value="No" in_do
| fillnull value="No" Owned
| fillnull value="No" In_full
| chart count by Owned

CSV details

do

deviceName | in_do | location | serialNo | uuid
| Yes | AAAA-AAA |AAAAAAAAAAA | AKAAIFKA112844921-129892184-19129

zoneserialnumbers csv

ProductName | SerialNumber | Owned
Numbers and letters | AAAAA1234AAAA | Yes

FullA_list csv
ComputerName | In_A_list | Location | SerialNumber | UDID
AAAAA-AAAAA | Yes | Country | AAAA1234AAA | AAAAAAAAAAAAAAAA-1234-AAAAAAAA

0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| rename COMMENT as "inputlookup fullA_list"
| eval _raw="ComputerName,In_A_list,Location,SerialNumber,UUID
AAAAA-AAAAA,Yes,Country,AAAA1234AAA,AAAAAAAAAAAAAAAA-1234-AAAAAAAA"
| multikv forceheader=1
| table ComputerName,In_A_list,Location,SerialNumber,UUID
| rename COMMENT as "inputlookup zonesserialnumbers"
| join SerialNumber [|makeresults
|eval _raw="ProductName,SerialNumber,Owned
Numbers and letters,AAAA1234AAA,Yes"
| multikv forceheader=1 
| table ProductName,SerialNumber,Owned]
| rename COMMENT as "inputlookup do"
| join SerialNumber type=outer [ | makeresults
| eval _raw="deviceName,in_do,location,serialNo,uuid
XXX,Yes,AAAA-AAA,AAAA1234AAA,AKAAIFKA112844921-129892184-19129"
| multikv forceheader=1
| table deviceName,in_do,location,serialNo,uuid
| rename serialNo as SerialNumber ]

Your query looks like good. What's wrong?

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| rename COMMENT as "inputlookup fullA_list"
| eval _raw="ComputerName,In_A_list,Location,SerialNumber,UUID
AAAAA-AAAAA,Yes,Country,AAAA1234AAA,AAAAAAAAAAAAAAAA-1234-AAAAAAAA"
| multikv forceheader=1
| table ComputerName,In_A_list,Location,SerialNumber,UUID
| rename COMMENT as "inputlookup zonesserialnumbers"
| join SerialNumber [|makeresults
|eval _raw="ProductName,SerialNumber,Owned
Numbers and letters,AAAA1234AAA,Yes"
| multikv forceheader=1 
| table ProductName,SerialNumber,Owned]
| rename COMMENT as "inputlookup do"
| join SerialNumber type=outer [ | makeresults
| eval _raw="deviceName,in_do,location,serialNo,uuid
XXX,Yes,AAAA-AAA,AAAA1234AAA,AKAAIFKA112844921-129892184-19129"
| multikv forceheader=1
| table deviceName,in_do,location,serialNo,uuid
| rename serialNo as SerialNumber ]

Your query looks like good. What's wrong?

0 Karma

rtalcik
Path Finder

idk, maybe just me overthinking it

0 Karma

to4kawa
Ultra Champion

Where is the CSV details?

rtalcik
Path Finder

I didnt drop them due to the data in them

0 Karma

to4kawa
Ultra Champion

If there is no detail, anyone can't resolve your problem.

0 Karma

rtalcik
Path Finder

i posted them

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...