<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How do I associate the CSV file content generated by the outputcsv command with index data? in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376282#M6432</link>
    <description>&lt;P&gt;Hi,&lt;BR /&gt;
Now I have to get a CSV file from an outputcsv command :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index="fortify"| stats values(Codelocation) as codelocation by source | rename source as source_yy| outputcsv three.csv
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and I can get a outputcsv like this :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; codelocation              source_yy
/root/taw/a                a_such.xml
/home/wxy/bc           b_code.xml
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I have the following index data :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;user=L_cu;sys_name=project_1;codeL=/root/taw/a;status=not_online;
user=A_by;sys_name=project_2;codeL=/home/wxy/bc;status=not_online;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Now, I want to use the outputcsv command to get a outputcsv file containing  &lt;CODE&gt;codeL,sys_name,source_yy&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;like these :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;     codeL                      sys_name                   source_yy
/root/taw/a                 project_1                    a_such.xml
/home/wxy/bc            project_2                    b_code.xml
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;codeL and codelocation have the same content.&lt;/P&gt;

&lt;P&gt;What should I do？&lt;/P&gt;</description>
    <pubDate>Mon, 05 Nov 2018 06:20:42 GMT</pubDate>
    <dc:creator>WXY</dc:creator>
    <dc:date>2018-11-05T06:20:42Z</dc:date>
    <item>
      <title>How do I associate the CSV file content generated by the outputcsv command with index data?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376282#M6432</link>
      <description>&lt;P&gt;Hi,&lt;BR /&gt;
Now I have to get a CSV file from an outputcsv command :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index="fortify"| stats values(Codelocation) as codelocation by source | rename source as source_yy| outputcsv three.csv
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;and I can get a outputcsv like this :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; codelocation              source_yy
/root/taw/a                a_such.xml
/home/wxy/bc           b_code.xml
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I have the following index data :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;user=L_cu;sys_name=project_1;codeL=/root/taw/a;status=not_online;
user=A_by;sys_name=project_2;codeL=/home/wxy/bc;status=not_online;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Now, I want to use the outputcsv command to get a outputcsv file containing  &lt;CODE&gt;codeL,sys_name,source_yy&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;like these :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;     codeL                      sys_name                   source_yy
/root/taw/a                 project_1                    a_such.xml
/home/wxy/bc            project_2                    b_code.xml
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;codeL and codelocation have the same content.&lt;/P&gt;

&lt;P&gt;What should I do？&lt;/P&gt;</description>
      <pubDate>Mon, 05 Nov 2018 06:20:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376282#M6432</guid>
      <dc:creator>WXY</dc:creator>
      <dc:date>2018-11-05T06:20:42Z</dc:date>
    </item>
    <item>
      <title>Re: How do I associate the CSV file content generated by the outputcsv command with index data?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376283#M6433</link>
      <description>&lt;P&gt;I do not think that CSV is necessary.&lt;BR /&gt;
You can edit it like this.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index="fortify"| stats values(Codelocation) as codeL  by source 
| rename source as source_yy
| join codeL  [search ( index data )| extract pairdelim=";", kvdelim="="]
| table codeL sys_name source_yy
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;※If you use CSV&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;( index data )| extract pairdelim=";", kvdelim="="]
　| join codeL  [search |inputcsv three.csv|renmae codelocation as codeL]
    | table codeL sys_name source_yy]
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 05 Nov 2018 08:32:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376283#M6433</guid>
      <dc:creator>HiroshiSatoh</dc:creator>
      <dc:date>2018-11-05T08:32:30Z</dc:date>
    </item>
    <item>
      <title>Re: How do I associate the CSV file content generated by the outputcsv command with index data?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376284#M6434</link>
      <description>&lt;P&gt;Thank you very much!&lt;/P&gt;</description>
      <pubDate>Tue, 06 Nov 2018 03:06:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-associate-the-CSV-file-content-generated-by-the/m-p/376284#M6434</guid>
      <dc:creator>WXY</dc:creator>
      <dc:date>2018-11-06T03:06:37Z</dc:date>
    </item>
  </channel>
</rss>

