Splunk Search

lookup multi value

ChetanArgekar
Explorer

I have multiple devices in a given location maintaining it lookup table with location and device.

Using location from index I am trying to get device list but output is coming in single row. I want list of devices as separate row. How to achieve it.

My query is like this

index =myindex

| lookup mylookup location OUTPUT devices 

| table devices

 

Labels (2)
0 Karma
1 Solution

ChetanArgekar
Explorer

Solved.

index = myindex

| lookup mylookup location OUTPUT devices 

| stats count(devices) by location, devices

| table devices 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ChetanArgekar,

please, try something like this:

index =myindex
| append [ | inputlookup mylookup | fields location devices ]
| stats values(devices) AS devices by location
| mvexpand devices

Ciao.

Giuseppe

0 Karma

ChetanArgekar
Explorer

thanks

It is giving only one device of location. I want list of every device of the location in separate row

0 Karma

ChetanArgekar
Explorer

Solved.

index = myindex

| lookup mylookup location OUTPUT devices 

| stats count(devices) by location, devices

| table devices 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...