Use csv (input/outputlookup) to display label from csv in pie chart

mhornste — Tue, 29 Sep 2020 14:24:42 GMT

Hi,

I have a working search which returns me IDs for specifing meanings of the values. I also have a working inputlookup file which has the sime IDs and the meaning of the IDs. I'd like to display the meaning value from the inputlookup file instead of the IDs. Is this possible?

Search:

index=rc sourcetype=OtcsRemoteCache Operation="1*" 
|  stats count by Operation

The lookup looks as follows:

OperationCode,Meaning,Direction
1001,Create Document,Remote Cache
1002,Get Version Metadata, Remote Cache
1003,Get Version Metadata from Cache, Remote Cache
1004,Get Version Content,Remote Cache
1005,Get Web Page, Remote Cache
1006,Get Document, Remote Cache
1007,Add Web Pages,Remote Cache
1008,Add Version,Remote Cache
1009,Promote Version,Remote Cache
1010,Delete,Remote Cache
1011,Get SNF for Document ID,Remote Cache
1012,Get Component Stream,Remote Cache
1013,Get Component Stream from Cache,Remote Cache
1014,Set Component Stream,Remote Cache
1015,Get Component Info,Remote Cache
1016,Get Component Info from Cache,Remote Cache
1017,Delete Component,Remote Cache
1018,Create Component,Remote Cache

The following search returns the correct values:
| inputlookup otcs_remote_cache_lookup.csv
| where Direction="Remote Cache"
| table Meaning, OperationCode

How can I display the Meaning field from the lookup in the pie chart instead of the IDs?

Thanks!

Martin

Re: Use csv (input/outputlookup) to display label from csv in pie chart

niketn — Tue, 29 Sep 2020 14:20:29 GMT

Create a Lookup Definition for otcs_remote_cache_lookup.csv as otcs_remote_cache_lookup from Settings > Lookup > Lookup Definition (grant required permission)

 index=rc sourcetype=OtcsRemoteCache Operation="1*" 
| stats count by Operation
| lookup otcs_remote_cache_lookup OperationCode as Operation output Meaning
| fields - Operation

topic Use csv (input/outputlookup) to display label from csv in pie chart in Splunk Search

Use csv (input/outputlookup) to display label from csv in pie chart

Re: Use csv (input/outputlookup) to display label from csv in pie chart