Splunk Search

join lookup based on the field

Muthu_Vinith
Path Finder

Hi, 
I'm trying to join two lookups based on the name field. Here's what i have,

|inputlookup abc.csv
|table name published
|lookup def.csv name as name OUTPUT releaseyear



When i run this, i get a multiple values in the field. How to get rid of these multiple values and ensure only one value per field?

Thanks!

Labels (1)
0 Karma

Muthu_Vinith
Path Finder

Thanks @yuanliu @ITWhisperer . It works

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Alternatively, you can do

|inputlookup abc.csv
|table name published
|lookup def.csv name as name OUTPUT releaseyear
| eval releaseyear = mvdedup(releaseyear)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming it is releaseyear that has the multiple values, you could try mvexpand

|inputlookup abc.csv
|table name published
|lookup def.csv name as name OUTPUT releaseyear
|mvexpand releaseyear
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...