Splunk Search

Merge two search results and add difference

malekseev
New Member

I have result of one search1 stored in csv by outpootlookup.
I use this lookup for the search2 as a criteria, e.g. what I need to find in search2.
My search

index="index1" source="source1" 
| lookup t.csv A OUTPUT A 
| stats count by A 
| rename A as A4, count as C4 
| table A4,C4
| sort A4
| appendcols 
    [| inputlookup t.csv 
    | table A,C
    | sort A]   

And the result looks like this:
alt text

Columns A,C - columns from criteria
Columns A4,C4 - columns from search

In the end I want to get table with columns:
A, C4
alt text
It means that in table colunms with names(column A) and count(column C4). But there is one condition: if one of A haven't been found in search, then use 0 as count for this line (I marked this cell by yellow color)

P.S. I've tried to do this by join but I always get result without cell bla3

0 Karma

vidhyaArumalla
Path Finder

Please try the below solution.

| inputlookup t.csv 
| table A,C 
| join A type=left 
    [ index="index1" source="source1" 
    | lookup t.csv A OUTPUT A "]
    | stats count(index) as C4 by A
    | sort A
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...