topic Re: Is it possible to add only some specific values from lookup? in Splunk Search

Is it possible to add only some specific values from lookup?

AlexeySh — Fri, 23 Mar 2018 16:20:17 GMT

Hello.

I use a dbxquery to import some user data including user priority. The result looks like this:

user    | priority
Bob     | low
Tom     | medium
Jack    | high
Bill    | low

At the same time I have a dynamic lookup table with users which currently has admin rights and I'd like to evaluate a priority for those users. The lookup looks like this:

user
Bob
Tom

What I’m trying to do is to add this line to my dbxquery:

| eval priority=if(isnotnull(|lookup my_lookup.csv user OUTPUT user), "high", priority)

But it doesn't work.

I tried to add a new column to my lookup table to make it look like this:

 user    | priority
 Bob     | high
 Tom     | high

and then simply add this line to my dbxquery:

| lookup my_lookup.csv user OUTPUT priority

But it doesn't work either. It actually erases a priority for all users who is not listed in lookup.

Do you have an advice how can I solve that issue?

Thanks for the help!

Re: Is it possible to add only some specific values from lookup?

tiagofbmm — Sat, 24 Mar 2018 07:22:04 GMT

So what you want is to make the priority of admin users as High, no matter what is coming from your dbxquery.

dbxquery  
| lookup my_lookup.csv user OUTPUT user as AdminUser
| eval priority=if(user==AdminUser,"high", priority)

Let use know if it works

Re: Is it possible to add only some specific values from lookup?

AlexeySh — Sat, 24 Mar 2018 09:41:04 GMT

Great!
That's exactly what a was searching for.
Thanks for your help!