topic Re: Splunk query that uses different lookup table depending on the day in Dashboards & Visualizations

Splunk query that uses different lookup table depending on the day

jwhit — Wed, 07 Sep 2016 14:49:42 GMT

Is it possible to have a splunk query use a different lookup table for a given day. For instance I want to use the lookup table on monday to cross-refernce with files that are suppose to run on Monday. On tuesday I would like to do the same but use a lookup table that corresponds to the jobs that is suppose to be ran on Tuesday. Can I do this in one search or would it require multiple searches in my dashboard.

Re: Splunk query that uses different lookup table depending on the day

sundareshr — Wed, 07 Sep 2016 16:46:06 GMT

Why not add a "day" column to your lookup table and have your query match on two fields. ... | eval dow=strftime(now(), "%a") | lookup somefile.csv day AS dow someotherfield AS someotherfield OUTPUT all fields | ...

Re: Splunk query that uses different lookup table depending on the day

vasanthmss — Wed, 07 Sep 2016 17:02:52 GMT

you can use the same lookup by adding separate column to keep date values as suggested in the above comment. In-case your lookup has more records and still you want to handled by name then you can try something like this,,

| lookup [|stats c | eval l=strftime(now(),"mylookup_%Y_%m_%d.csv")] primary_key OUTPUT field1, field2 ..

here lookup will be like this,

mylookup_2016_09_06.csv 
mylookup_2016_09_07.csv

By changing the date variable you can create your lookup name in sub search and pass ...

hope this will help you.

Re: Splunk query that uses different lookup table depending on the day

jwhit — Thu, 08 Sep 2016 16:24:37 GMT

Thanks I think this will do. Sidenote I have been getting an File not end of line error when trying to upload an excel spreadsheet converted to a CSV. Any suggestion on this?