Splunk Search

How to join two different result sharing common field?

yohhpark
Path Finder

Search 1.

| inputlookup test1.csv

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| table ITEM 1 ITEM3

 

Conclusion.

I want it to show

|table ITEM1 ITEM2 ITEM3

 

but my results are showing

ITEM1 ITEM2

ITEM1 ITEM2

ITEM1               ITEM3

ITEM1               ITEM3

 

 

Question.

How can I join the Item1s? so that I get a result of

ITEM1 ITEM2 ITEM3

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You should show us what is the code that gave you the "wrong" results.

Here is an alternative to @gcusello's:

| inputlookup test1.csv output ITEM1 ITEM2
| lookup test2.csv ITEM1 output ITEM3
| table ITEM 1 ITEM2 ITEM3

Efficiency-wise, use the smaller of the two as test1.csv.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yohhpark ,

please try this:

| inputlookup test1.csv
| append [ | inputlookup test2.csv ]
| stats values(ITEM2) AS ITEM2 values(ITEM3) AS ITEM3 BY ITEM1

Ciao.

Giuseppe

yohhpark
Path Finder

One problem.

Let say I have a result below

ID         Status       Remark               Values

11         PASS          CHECKED         something something hello

371      FAILED       CONFIRMED    someting hello SOME

 

let say I want to input another field from a inputlookup that is correlated with the ID number.

ex)

| inputlookup test

|table ID ActualName

 

which the results comes out

11       McDonald

371    BurgerKing

 

 

HOW TO simply input that result into the first query so that I can get a result as below?

ID        ActualValue              Status       Remark               Values

11       McDonald                   PASS          CHECKED         something something hello

371      BurgerKing                FAILED       CONFIRMED    someting hello SOME

0 Karma

yohhpark
Path Finder

ITEM1 are the results of eval.

EX)

 

Search 1.

| inputlookup test1.csv

| eval ITEM1(something)

| eval ITEM2(something)

| table ITEM1 ITEM2

 

Search 2.

| inputlookup test2.csv

| eval ITEM1(something)

| eval ITEM3(something)

| table ITEM 1 ITEM3

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...