Splunk Search

pass value of field from one search to another when using appendpipe

nagar57
Communicator
**I have a below search query:**
| inputlookup splunk_report_test.csv 
| where report_type="upcoming_offers" 
| lookup vatson_splunk_report_test_lookup report_type outputnew _key as pKey,email_id,flag 
| appendpipe 
    [| fields email_id,report_type,flag,pKey 
    | dedup pKey 
    | appendpipe 
        [| inputlookup vatson_splunk_report_test_lookup 
        | eval test_flag=if (match(pKey,_key),"close","open") 
        | fields email_id,flag,test_flag,pKey,test_key,report_type 
        | outputlookup test_vatson_test.csv] 
        ] 
| table name,age,country,email_id,flag,pKey,test_flag,pkey_list

My pKey value is not getting passed to the inner most inputlookup query. I need the pkey value passed to my below query:

[| inputlookup vatson_splunk_report_test_lookup 
         | eval test_flag=if (match(pKey,_key),"close","open") 
         | fields email_id,flag,test_flag,pKey,test_key,report_type 
         | outputlookup test_vatson_test.csv] 
         ] 

How can I achieve this?
TIA !!

0 Karma

to4kawa
Ultra Champion

what's pKey and _key?
Looking your query, both are from same csv.

0 Karma

nagar57
Communicator

lookup vatson_splunk_report_test_lookup is a KeyValue Store which have _key and pKey contains the values just like _key

0 Karma

to4kawa
Ultra Champion

There is no information to consider the query.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...