Splunk Search

help on subsearch in order to match a common field between 2 lookup files

jip31
Motivator

hi

In a first lookup (host.csv), I have a field "host"
In a second lookup (toto.csv), I have also a field "host"
Is it enough to do
| inputlookup host.csv
| appendcols
[| inputlookup toto.csv]
for that the host in the first lookup match with the host in the second lookup?
Is there also any way to do this?
thanks

Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

For example

| inputlookup host.csv |dedup host| eval no=1
| append [| inputlookup toto.csv |dedup host|eval no=2]
| stats sum(no) as no by host
| eval match=case(no==1,"host.csv",no==2,"toto.csv",no==3,"match")

If only matches

| inputlookup host.csv 
| search [| inputlookup toto.csv |dedup host|table host]

View solution in original post

0 Karma

HiroshiSatoh
Champion

For example

| inputlookup host.csv |dedup host| eval no=1
| append [| inputlookup toto.csv |dedup host|eval no=2]
| stats sum(no) as no by host
| eval match=case(no==1,"host.csv",no==2,"toto.csv",no==3,"match")

If only matches

| inputlookup host.csv 
| search [| inputlookup toto.csv |dedup host|table host]
0 Karma

jip31
Motivator

PERFECT THANKS

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...