Splunk Enterprise

Lookup comparison

iamtheclient20
Explorer

Hello,

Example I have 2 lookups, first.csv and second.csv

first.csv have 1 column name=fruit_name and with multivalue

first.csv

fruit_name
apple
banana
melon
mango
grapes
guyabano
coconut



second.csv have 2 column fruits and remarks with multivalue under fruits column

fruits

remarks

apple
mango
guyabano

visible


How can i check if all the values of second.csv (apple,mango,guyabano) are present in the column fruit_name under first.csv then echo out the remarks with the value of visible


Thanks in advance

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

how have you set up your csv files so that they have multivalue fields?

0 Karma
Get Updates on the Splunk Community!

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...