Splunk Search

lookup multi value

ChetanArgekar
Explorer

I have multiple devices in a given location maintaining it lookup table with location and device.

Using location from index I am trying to get device list but output is coming in single row. I want list of devices as separate row. How to achieve it.

My query is like this

index =myindex

| lookup mylookup location OUTPUT devices 

| table devices

 

Labels (2)
0 Karma
1 Solution

ChetanArgekar
Explorer

Solved.

index = myindex

| lookup mylookup location OUTPUT devices 

| stats count(devices) by location, devices

| table devices 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ChetanArgekar,

please, try something like this:

index =myindex
| append [ | inputlookup mylookup | fields location devices ]
| stats values(devices) AS devices by location
| mvexpand devices

Ciao.

Giuseppe

0 Karma

ChetanArgekar
Explorer

thanks

It is giving only one device of location. I want list of every device of the location in separate row

0 Karma

ChetanArgekar
Explorer

Solved.

index = myindex

| lookup mylookup location OUTPUT devices 

| stats count(devices) by location, devices

| table devices 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...