Splunk lookup multiple fields field how to#

Yours would be like this: | inputlookup Applications. I have a lookup that returns multiple matches. Then create a Lookup definition with Maximum matches set to something large like 20. inputlookup MyLookup.csv makemv delim' ' emails mvexpand emails outputcsv MyLookup.csv. Yours would be like this: | inputlookup Applications.csv Multivalued fields are supported in KV-based lookups, but not in file-based lookups.

The eval command has a number of useful functions. There are a variety of commands and functions within Splunk that can manipulate multi-valued fields. If there are multiple matches, the output fields are created as multi-valued fields. This example takes each row from the incoming search results and then create a new row with for each value in the c field. Yes, Splunk will return more than 1 match. Each field has the following corresponding values: You run the mvexpand command and specify the c field. | stats values(multifield) AS multifield values(Application) AS Application BY AppNo You should try it and look at the results. | strcat FuncNo ',' Functionality multifield I think you may be making some incorrect assumptions about how things work. (indexindex2 sourcetypest2) OR (indexindex1 sourcetypest1) fields appId, resourceId appDisplayName resourceDisplayName rename COMMENT as 'above selects only the record types and fields you need' rename COMMENT as 'create synthetic fields as per diogofm answer' eval appId. | eval raw = '1,1,func1 1,2,func2 2,1,func3 2,2,func4 2,3,func5' Don't use a subsearch where the stats can handle connecting the two. I still do not get exactly why the lookup is not adequate, but here is another way, without lookup in run-anywhere code: | makeresults Am I doing something incorrectly, or does this really not work?įunctionalities.csv AppNo,FuncNo,Functionalityĭesired output AppNo, Application, FuncNo, Functionality Trying to read the lowest layer first is weird.

Splunk lookup multiple fields field how to#

How to combine 2 fields into 1 in Splunk in an alt. dataset () The function syntax returns all of the fields in the events that match your search criteria. Increased performance for searches using the lookup command with parallel reduce search processing. There are three supported syntaxes for the dataset () function: Syntax. The first 1 is much easier to read for anyone who comes after me, especially since I have 2 more input tables to join. You can use this function in the SELECT clause in the from command and with the stats command. Since join and type are dangerously similar to SQL, why does this not behave like SQL? I can only get all 30 rows when i switch the two lookup tables around, which shouldn't matter since it's an inner join. There are many more AppNo field values with a match in both tables, but only 4 are pulled. This will only ever pull 4 total rows, even if Functionalities.csv contains 30 matching AppNo field values. This will pull all 4 rows in Applications.csv, and only 4 rows in Functionalities.csv. To make the logic easy to read, I want the first table to be the one whose data is higher up in hierarchy.