Splunk Search

Merge two search results and add difference

malekseev
New Member

I have result of one search1 stored in csv by outpootlookup.
I use this lookup for the search2 as a criteria, e.g. what I need to find in search2.
My search

index="index1" source="source1" 
| lookup t.csv A OUTPUT A 
| stats count by A 
| rename A as A4, count as C4 
| table A4,C4
| sort A4
| appendcols 
    [| inputlookup t.csv 
    | table A,C
    | sort A]   

And the result looks like this:
alt text

Columns A,C - columns from criteria
Columns A4,C4 - columns from search

In the end I want to get table with columns:
A, C4
alt text
It means that in table colunms with names(column A) and count(column C4). But there is one condition: if one of A haven't been found in search, then use 0 as count for this line (I marked this cell by yellow color)

P.S. I've tried to do this by join but I always get result without cell bla3

0 Karma

vidhyaArumalla
Path Finder

Please try the below solution.

| inputlookup t.csv 
| table A,C 
| join A type=left 
    [ index="index1" source="source1" 
    | lookup t.csv A OUTPUT A "]
    | stats count(index) as C4 by A
    | sort A
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...