topic Re: Lookup csv file in Splunk Search

Lookup csv file

shangshin — Mon, 07 May 2012 20:04:38 GMT

Hi,
I would like to upload a csv file as a lookup table. what will be header format?
Assuming I have a search field called customer_id. So jsmith means John Smith.
Can you use this as an example to provide a one line csv file?

I trtied jsmith, John Smith
but didn't work out.

Thanks!

Re: Lookup csv file

Ayn — Mon, 07 May 2012 20:16:08 GMT

This is covered very well in the docs - I could write examples here but really the docs explain it all: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Example_of_static_fields_lookup

Re: Lookup csv file

sdaniels — Mon, 28 Sep 2020 11:46:46 GMT

Example lookup configuration in the docs. Create your file like this and then follow the links below for an example on how to set it up and then how they get used in searches.

customer_id, customer_name
jsmith,John Smith

http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources

Re: Lookup csv file

shangshin — Mon, 28 Sep 2020 11:46:59 GMT

Good anwser. Thanks!

Assuming the lookup csv file contains the customer's associated firm. e.g.
customer_id, customer_name, customer_firm
jsmith,John Smith,Google

What will be the search string to see top 10 users' name and firm?
The search below will display name, count, percentage.
sourcetype="access_common" | top customer_name

Re: Lookup csv file

Ayn — Tue, 08 May 2012 16:07:06 GMT

Because customer_name and firm will always have the same 1:1 mapping (right?) you can just do

... | top customer_name,firm