Hello my fellow Splunkers, i am trying to use a second index as a lookup for a field in the first index
index=products contains the products serialNumbers1 index=inventory contains the products serialNumbersAll and productsNames serialNumbers1 is a subset of serialNumbersAll
i need to table serialNumbers1 and the equvelant productsNames example:
(index=products OR index=inventory) |table serialNumbers1 serialNumbersAll productsNames
we get
serialNumbers1 serialNumbersAll productsNames 111 222 333 444 111 apple 222 orange 333 banana 444 kiwi 555 666 777 888 the desired output is
serialNumbers1 serialNumbersAll productsNames 111 apple 222 orange 333 banana 444 kiwi 111 apple 222 orange 333 banana 444 kiwi 555 lemon 666 vege 777 potatoes 888 sweet potatoes notes: i have a huge set of data more than 200K so using eventstats is not an option as it hits the limit, increasing the limit is not an option also using a lookup table is not an option for me as well
... View more