Splunk Search

pass value of field from one search to another when using appendpipe

nagar57
Communicator
**I have a below search query:**
| inputlookup splunk_report_test.csv 
| where report_type="upcoming_offers" 
| lookup vatson_splunk_report_test_lookup report_type outputnew _key as pKey,email_id,flag 
| appendpipe 
    [| fields email_id,report_type,flag,pKey 
    | dedup pKey 
    | appendpipe 
        [| inputlookup vatson_splunk_report_test_lookup 
        | eval test_flag=if (match(pKey,_key),"close","open") 
        | fields email_id,flag,test_flag,pKey,test_key,report_type 
        | outputlookup test_vatson_test.csv] 
        ] 
| table name,age,country,email_id,flag,pKey,test_flag,pkey_list

My pKey value is not getting passed to the inner most inputlookup query. I need the pkey value passed to my below query:

[| inputlookup vatson_splunk_report_test_lookup 
         | eval test_flag=if (match(pKey,_key),"close","open") 
         | fields email_id,flag,test_flag,pKey,test_key,report_type 
         | outputlookup test_vatson_test.csv] 
         ] 

How can I achieve this?
TIA !!

0 Karma

to4kawa
Ultra Champion

what's pKey and _key?
Looking your query, both are from same csv.

0 Karma

nagar57
Communicator

lookup vatson_splunk_report_test_lookup is a KeyValue Store which have _key and pKey contains the values just like _key

0 Karma

to4kawa
Ultra Champion

There is no information to consider the query.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...