All Apps and Add-ons

Append and lookup

kangje168
Explorer

Hello,
We have 2 log files with a coloum in common. I saved the first search and use "lookup" to connect it to the second search.
While my colleague, he use "append". We got two very close result, but they are not the same. Just 1 or 2 different in the total number in the result. Could anybody told me, whose search is more precise? Or under what circumustance, "lookup", or "append", is more precise ?

Thank you very much.

0 Karma

xpac
SplunkTrust
SplunkTrust

In general, both variants are precise. However, lookup uses data saved before, so it might be a little less recent than append, simply because the data has changed in the meantime.

If your data did not change inbetween, I would try to do a search in the results, to find out what exactly makes for those "off by 1-2" differences - because then they should yield the same results.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...