topic Re: How to add a column/field based on csv table in Getting Data In

How to add a column/field based on csv table

AllenZhang — Thu, 01 Oct 2015 13:53:26 GMT

I have a search like:
sourcetype="AAA"|table _time userid, and I have a table like userid, username,
how to make the result as .....|table _time userid username.

Re: How to add a column/field based on csv table

pradeepkumarg — Thu, 01 Oct 2015 13:55:39 GMT

upload your csv as a lookup table. Once you create a definition for your lookup, you can achieve with the below search

sourcetype="AAA" | lookup your_csv_definition_name userid output username | table _time userid username

Re: How to add a column/field based on csv table

richgalloway — Thu, 01 Oct 2015 14:03:27 GMT

Something like this should get you started.

sourcetype="AAA" | lookup file.csv userid OUTPUT username | table _time userid username

If you create an automatic lookup you can omit the lookup command from the search.

Re: How to add a column/field based on csv table

AllenZhang — Thu, 01 Oct 2015 14:07:29 GMT

Thanks for quick answer. I am still struggling how to upload the csv file from my computer to splunk, to make it available to the lookups. Do I need to save it to some certain folder, anything like "import" I need to do?

Re: How to add a column/field based on csv table

pradeepkumarg — Thu, 01 Oct 2015 17:07:57 GMT

go to settings -> lookups >lookup table files -> new

Re: How to add a column/field based on csv table

AllenZhang — Fri, 02 Oct 2015 21:02:27 GMT

I was going to accept both answers, but the system only allows one. Thanks to both of you!