Splunk Search

How to join two different result sharing common field?

yohhpark
Path Finder

Search 1.

| inputlookup test1.csv

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| table ITEM 1 ITEM3

 

Conclusion.

I want it to show

|table ITEM1 ITEM2 ITEM3

 

but my results are showing

ITEM1 ITEM2

ITEM1 ITEM2

ITEM1               ITEM3

ITEM1               ITEM3

 

 

Question.

How can I join the Item1s? so that I get a result of

ITEM1 ITEM2 ITEM3

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You should show us what is the code that gave you the "wrong" results.

Here is an alternative to @gcusello's:

| inputlookup test1.csv output ITEM1 ITEM2
| lookup test2.csv ITEM1 output ITEM3
| table ITEM 1 ITEM2 ITEM3

Efficiency-wise, use the smaller of the two as test1.csv.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

yohhpark
Path Finder

One problem.

Let say I have a result below

ID         Status       Remark               Values

11         PASS          CHECKED         something something hello

371      FAILED       CONFIRMED    someting hello SOME

 

let say I want to input another field from a inputlookup that is correlated with the ID number.

ex)

| inputlookup test

|table ID ActualName

 

which the results comes out

11       McDonald

371    BurgerKing

 

 

HOW TO simply input that result into the first query so that I can get a result as below?

ID        ActualValue              Status       Remark               Values

11       McDonald                   PASS          CHECKED         something something hello

371      BurgerKing                FAILED       CONFIRMED    someting hello SOME

0 Karma

yohhpark
Path Finder

ITEM1 are the results of eval.

EX)

 

Search 1.

| inputlookup test1.csv

| eval ITEM1(something)

| eval ITEM2(something)

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| eval ITEM1(something)

| eval ITEM3(something)

| table ITEM 1 ITEM3

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...