Splunk Search

join lookup based on the field

Muthu_Vinith
Path Finder

Hi, 
I'm trying to join two lookups based on the name field. Here's what i have,

|inputlookup abc.csv
|table name published
|lookup def.csv name as name OUTPUT releaseyear



When i run this, i get a multiple values in the field. How to get rid of these multiple values and ensure only one value per field?

Thanks!

Labels (1)
0 Karma

Muthu_Vinith
Path Finder

Thanks @yuanliu @ITWhisperer . It works

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Alternatively, you can do

|inputlookup abc.csv
|table name published
|lookup def.csv name as name OUTPUT releaseyear
| eval releaseyear = mvdedup(releaseyear)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming it is releaseyear that has the multiple values, you could try mvexpand

|inputlookup abc.csv
|table name published
|lookup def.csv name as name OUTPUT releaseyear
|mvexpand releaseyear
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...