Splunk Enterprise

join two lookup tables

sarit_s
Communicator

Hello
i have two lookup tables 

from the first i want to take the field "created_by"
from the second i want to compare the "created_by" fields from the first lookup and check if the field "description" is empty or not.

if empty i want to raise an alert.

How can i join this two lookups?

thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

So,  you can use below;

| inputlookup first_lookup
| lookup second_lookup eventtype as created_by OUTPUT description
| where isnull(description)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

If you are getting this error second_lookup has no "eventtype" field. Is it possible a typo?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

So,  you can use below;

| inputlookup first_lookup
| lookup second_lookup eventtype as created_by OUTPUT description
| where isnull(description)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sarit_s
Communicator

i'm getting this error:
Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sarit_s,

Please try below;

| inputlookup first_lookup
| lookup second_lookup created_by OUTPUT description
| where isnull(description)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sarit_s
Communicator

Hey,

Thanks for your reply
i think i forgot to mention that in the second lookup the field has different name so for example created_by (from first lookup) has to be equal to "eventtype" from second lookup and then i have to check if description is empty

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...