topic Re: How to add content from lookup table data in Getting Data In

How to add content from lookup table data?

sekhar463 — Tue, 20 Dec 2022 13:58:51 GMT

Good day All!

i have created a lookup data | inputlookup Autosys.csv and i have fileds KB,REGION AND JOB_NAME.

i have splunk search which i have some job data .

how can ingest other fields in the lookup using JOB_NAME as common fileds splunk events

below is the search which i want to add lookup data

index=index_name sourcetype=source_name | eval Actualstarttime=strftime(strptime(NEXT_START,"%Y/%m/%d %H:%M:%S"),"%H:%M") | eval Job_start_by=strftime(strptime(LAST_START,"%Y/%m/%d %H:%M:%S"),"%H:%M") | eval START_SLA=if(Job_start_by <= Actualstarttime,"Started On Time","Started Late") | eval END_SLA=if(RUNTIME <= AVG_RUN_TIME,"END ONTIME","END SLA BREACH") | search NEXT_START!=NULL | table JOB_NAME,JOB_GROUP,TIMEZONE,STATUS,Currenttime,STATUS_TIME,LAST_START,LAST_END,NEXT_START,DAYS_OF_WEEK,EXCLUDE_CALENDAR,RUNTIME,Actualstarttime,Job_start_by,START_SLA,AVG_RUN_TIME,END_SLA

Re: How to add content from lookup table data

Manasa_401 — Tue, 20 Dec 2022 10:16:31 GMT

Hello @sekhar463

If you want to include lookup data in the search using a common field then add below line to your query.

|lookup Autosys.csv JOB_NAME OUTPUT KB REGION

If this helps, an upvote would be appreciated.

Thanks,

Manasa

Re: How to add content from lookup table data

sekhar463 — Tue, 20 Dec 2022 10:42:00 GMT

Hello Mansa your awesome.

why its not worked even i have tried with automatic lookup as well

Re: How to add content from lookup table data

Manasa_401 — Tue, 20 Dec 2022 10:58:35 GMT

Have you created lookup definition? If not try it.

Re: How to add content from lookup table data

gcusello — Tue, 20 Dec 2022 10:59:35 GMT

Hi @sekhar463,

if you want to use the data from lookup to enrich your search data, you can use the lookup command (as interd by @Manasa_401 ).

If instead you want to save data from your search in the lookup, you have to explore the outputlookup command (https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Outputlookup) that must be added at the end of your search.

Ciao.

Giuseppe

Re: How to add content from lookup table data

sekhar463 — Tue, 20 Dec 2022 11:16:07 GMT

hai yeah manasa i have created lookup definition and created automatic lookup as well for the source type

after that i am searching with query the filelds are not added