<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Joining Alert lookup file with a mapping file depending on pattern search in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591437#M48509</link>
    <description>&lt;LI-CODE lang="markup"&gt;| inputlookup Horizon.csv
| eval Name=if(Type="Autosys",GRN,"all")
| lookup Mapping.csv Type Name&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 30 Mar 2022 08:23:32 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2022-03-30T08:23:32Z</dc:date>
    <item>
      <title>How to Join Alert lookup file with a mapping file depending on pattern search?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591418#M48506</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;
&lt;P&gt;I have a alert dump data Horizon.csv having important columns like below:&lt;/P&gt;
&lt;P&gt;Alert&amp;nbsp; &amp;nbsp;GRN&amp;nbsp; &amp;nbsp;Type ....&lt;/P&gt;
&lt;P&gt;PNC/hz-hfp-l-abc[MAXRUN]&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;PNC/hz-hfp-l-abc&amp;nbsp; &amp;nbsp;Autosys&lt;/P&gt;
&lt;P&gt;Filesystem[ivp1234.xy.com] [91&amp;gt;90]&amp;nbsp; &amp;nbsp;ivp1234.xy.com&amp;nbsp; &amp;nbsp;Application&lt;/P&gt;
&lt;P&gt;Filesystem[ivp1244.xy.com] [91&amp;gt;90]&amp;nbsp; &amp;nbsp;ivp1244.xy.com&amp;nbsp; &amp;nbsp;Application&lt;/P&gt;
&lt;P&gt;p.start.script.pl is down&amp;nbsp; &amp;nbsp; &amp;nbsp;Process down&amp;nbsp; &amp;nbsp;API&lt;/P&gt;
&lt;P&gt;which I need to merge with Mapping.csv but on a condition that if Type=Autosys then merge on GRN else merge on Type&lt;/P&gt;
&lt;P&gt;details of Mapping.csv&lt;/P&gt;
&lt;P&gt;Type&amp;nbsp; &amp;nbsp;Name&amp;nbsp; &amp;nbsp;Module&amp;nbsp; &amp;nbsp; Header&lt;/P&gt;
&lt;P&gt;Autosys&amp;nbsp; &amp;nbsp;hz-hfp-l-abc&amp;nbsp; &amp;nbsp;HF&amp;nbsp; &amp;nbsp;EOD Job&lt;/P&gt;
&lt;P&gt;Application&amp;nbsp; &amp;nbsp;&amp;lt;blank&amp;gt;&amp;nbsp; &amp;nbsp;Eng&amp;nbsp; &amp;nbsp;Server alerts&lt;/P&gt;
&lt;P&gt;API&amp;nbsp; &amp;nbsp;&amp;lt;blank&amp;gt;&amp;nbsp; &amp;nbsp;LF&amp;nbsp; &amp;nbsp;Service alerts&amp;nbsp; &amp;nbsp;&lt;/P&gt;
&lt;P&gt;I need output as&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Alert&amp;nbsp; &amp;nbsp;GRN&amp;nbsp; &amp;nbsp;Type&amp;nbsp; &amp;nbsp;Module&amp;nbsp; &amp;nbsp;Header&lt;/P&gt;
&lt;P&gt;PNC/hz-hfp-l-abc[MAXRUN]&amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;PNC/hz-hfp-l-abc&amp;nbsp; &amp;nbsp;Autosys&amp;nbsp; &amp;nbsp;HF&amp;nbsp; &amp;nbsp;EOD Job&lt;/P&gt;
&lt;P&gt;Filesystem[ivp1234.xy.com] [91&amp;gt;90]&amp;nbsp; &amp;nbsp;ivp1234.xy.com&amp;nbsp; &amp;nbsp;Application&amp;nbsp; &amp;nbsp;Eng&amp;nbsp; &amp;nbsp;Server alerts&lt;/P&gt;
&lt;P&gt;Filesystem[ivp1244.xy.com] [91&amp;gt;90]&amp;nbsp; &amp;nbsp;ivp1244.xy.com&amp;nbsp; &amp;nbsp;Application&amp;nbsp; &amp;nbsp;Eng&amp;nbsp; &amp;nbsp;Server alerts&lt;/P&gt;
&lt;P&gt;p.start.script.pl is down&amp;nbsp; &amp;nbsp; &amp;nbsp;Process down&amp;nbsp; &amp;nbsp;API&amp;nbsp; &amp;nbsp;LF Service alerts&lt;/P&gt;</description>
      <pubDate>Wed, 30 Mar 2022 16:13:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591418#M48506</guid>
      <dc:creator>jinishshah</dc:creator>
      <dc:date>2022-03-30T16:13:49Z</dc:date>
    </item>
    <item>
      <title>Re: Joining Alert lookup file with a mapping file depending on pattern search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591423#M48507</link>
      <description>&lt;P&gt;Assuming &amp;lt;blank&amp;gt; fields are blank string and not null, try something like this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| inputlookup Horizon.csv
| eval Name=if(Type="Autosys",GRN,"")
| lookup Mapping.csv Type Name&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 30 Mar 2022 07:43:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591423#M48507</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-03-30T07:43:34Z</dc:date>
    </item>
    <item>
      <title>Re: Joining Alert lookup file with a mapping file depending on pattern search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591434#M48508</link>
      <description>&lt;P&gt;Thanks for your quick reply&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;. Merging for Type=Autosys is working fine but not for others. I am getting blank output in others. What if I change &amp;lt;blank&amp;gt; in Mapping.csv to "all". What will be the query then ?&lt;/P&gt;</description>
      <pubDate>Wed, 30 Mar 2022 08:12:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591434#M48508</guid>
      <dc:creator>jinishshah</dc:creator>
      <dc:date>2022-03-30T08:12:46Z</dc:date>
    </item>
    <item>
      <title>Re: Joining Alert lookup file with a mapping file depending on pattern search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591437#M48509</link>
      <description>&lt;LI-CODE lang="markup"&gt;| inputlookup Horizon.csv
| eval Name=if(Type="Autosys",GRN,"all")
| lookup Mapping.csv Type Name&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 30 Mar 2022 08:23:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591437#M48509</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-03-30T08:23:32Z</dc:date>
    </item>
    <item>
      <title>Re: Joining Alert lookup file with a mapping file depending on pattern search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591448#M48510</link>
      <description>&lt;P&gt;Hey&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;, it worked for Module column but not working as expected for Header column. Picking up wrong value&lt;/P&gt;</description>
      <pubDate>Wed, 30 Mar 2022 09:05:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591448#M48510</guid>
      <dc:creator>jinishshah</dc:creator>
      <dc:date>2022-03-30T09:05:14Z</dc:date>
    </item>
    <item>
      <title>Re: Joining Alert lookup file with a mapping file depending on pattern search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591452#M48512</link>
      <description>&lt;P&gt;In what way is it wrong? What are you getting? What are you expecting?&lt;/P&gt;</description>
      <pubDate>Wed, 30 Mar 2022 09:18:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591452#M48512</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-03-30T09:18:28Z</dc:date>
    </item>
    <item>
      <title>Re: Joining Alert lookup file with a mapping file depending on pattern search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591454#M48513</link>
      <description>&lt;P&gt;Sorry My Bad.....Its works Superbly !!! Thanks for your quick answer !!! Really appreciated !!&lt;/P&gt;</description>
      <pubDate>Wed, 30 Mar 2022 09:24:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Join-Alert-lookup-file-with-a-mapping-file-depending-on/m-p/591454#M48513</guid>
      <dc:creator>jinishshah</dc:creator>
      <dc:date>2022-03-30T09:24:47Z</dc:date>
    </item>
  </channel>
</rss>

