https://community.splunk.com/t5/Getting-Data-In/How-to-show-customized-data-in-output/m-p/643259#M109613 <P>There is more than one way to do it. Since you mentioned csv already, <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutlookupsandfieldactions#Types_of_lookups" target="_self">let's use that</A>. I'm going to assume it has two columns, uuid and client_id.</P><P>You need your csv in Splunk for this of course - so <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Upload_the_lookup_table_file" target="_self">either upload it</A> or create it in Splunk if you haven't done so already. Next, I'd suggest you <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Create_a_CSV_lookup_definition" target="_self">create a lookup definition</A> for your csv file. Then, you'd use your lookup like this:</P><PRE>index=this &lt;your search finding UUIDs&gt;<BR />| lookup your_lookup_definition uuid OUTPUT client_id<BR />| table _time client_id src_ip method (or whatever other fields you want)</PRE><P>If this is something you always want for this type of data, you might want to consider <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/DefineanautomaticlookupinSplunkWeb" target="_self">an automatic lookup</A>. That would make splunk implicitly run that | lookup command for all searches against e.g. this sourcetype, so you wouldn't need to have it in every SPL explicitly.</P> Sat, 13 May 2023 05:18:13 GMT jeffland 2023-05-13T05:18:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-show-customized-data-in-output/m-p/643257#M109612 <P>Hi, I've recently started using Splunk logs. I have a query to fetch client IDs who call my APIs. These client IDs are some UUIDs. I would rather like to see a customized name for these IDs.&nbsp;</P><P>For example, I can save the mapping of the client ID and its easy-to-read client name in a CSV or somewhere and want my Splunk query to show the client name.</P><P>Is this possible? Could someone help how to do it?</P> Sat, 13 May 2023 01:28:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-show-customized-data-in-output/m-p/643257#M109612 avd 2023-05-13T01:28:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-show-customized-data-in-output/m-p/643259#M109613 <P>There is more than one way to do it. Since you mentioned csv already, <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutlookupsandfieldactions#Types_of_lookups" target="_self">let's use that</A>. I'm going to assume it has two columns, uuid and client_id.</P><P>You need your csv in Splunk for this of course - so <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Upload_the_lookup_table_file" target="_self">either upload it</A> or create it in Splunk if you haven't done so already. Next, I'd suggest you <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Create_a_CSV_lookup_definition" target="_self">create a lookup definition</A> for your csv file. Then, you'd use your lookup like this:</P><PRE>index=this &lt;your search finding UUIDs&gt;<BR />| lookup your_lookup_definition uuid OUTPUT client_id<BR />| table _time client_id src_ip method (or whatever other fields you want)</PRE><P>If this is something you always want for this type of data, you might want to consider <A href="https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/DefineanautomaticlookupinSplunkWeb" target="_self">an automatic lookup</A>. That would make splunk implicitly run that | lookup command for all searches against e.g. this sourcetype, so you wouldn't need to have it in every SPL explicitly.</P> Sat, 13 May 2023 05:18:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-show-customized-data-in-output/m-p/643259#M109613 jeffland 2023-05-13T05:18:13Z