Splunk Search

Search two lookup tables for matching field values

marktechuk
New Member

Hi trying to search two lookup tables for matching fields values, both tables have the same fields.
Just looking to compare my output UserFromTest1 and UserFromTest2 for a match.

| inputlookup test1.csv UserName as User OutputNew User as UserFromTest1
| inputlookup test2.csv UserName as User OutputNew User as UserFromTest2

Thanks

0 Karma
1 Solution

rahulbhatia
Path Finder

| inputlookup Test1.csv
| fields UserName, Count | rename Count as Count1
| join type=inner UserName
[| inputlookup Test2.csv
| fields UserName, Count | rename Count as count2]

It will show you the list of UserName's which are present in both the table, i have added count column to show the 2 different count value for the same UserName

View solution in original post

0 Karma

rahulbhatia
Path Finder

| inputlookup Test1.csv
| fields UserName, Count | rename Count as Count1
| join type=inner UserName
[| inputlookup Test2.csv
| fields UserName, Count | rename Count as count2]

It will show you the list of UserName's which are present in both the table, i have added count column to show the 2 different count value for the same UserName

0 Karma

marktechuk
New Member

Worked great, thanks

0 Karma

wmyersas
Builder

You need to |where after the lookups (and I'd suggest case-insensitivizing it):

<first part of search>
| inputlookup test1.csv UserName as User OutputNew User as UserFromTest1
| inputlookup test2.csv UserName as User OutputNew User as UserFromTest2
| eval UserFromTest2=upper(UserFromTest2)
| eval UserFromTest1=upper(UserFromTest1)
| where UserFromTest2=UserFromTest1
| <rest of search goes here>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...