topic Re: How do I convert a country name to country code (or vice versa)? in Splunk Search

How do I convert a country name to country code (or vice versa)?

nick405060 — Thu, 23 Aug 2018 17:46:55 GMT

How do I convert a CC to a country name in Splunk, or vice versa?

Since Splunk Answers won't let me post this question without it being longer (#logic), I need to do:

| makeresults | eval cc="US" | eval country="United States" | <test if they are equal>

Re: How do I convert a country name to country code (or vice versa)?

pruthvikrishnap — Thu, 23 Aug 2018 18:07:22 GMT

you can use the replace command to do this.

https://answers.splunk.com/answers/568552/how-to-use-replace-in-search.html
Let me know if this helps.

Re: How do I convert a country name to country code (or vice versa)?

nick405060 — Thu, 23 Aug 2018 18:18:24 GMT

That wouldn't work because CCs aren't uniform. FR is the first two characters of the country name, while US is the first and eighth character of the country name, CN is the first and fourth letter of the country name.

Re: How do I convert a country name to country code (or vice versa)?

pruthvikrishnap — Thu, 23 Aug 2018 18:37:04 GMT

if you have a list of CC's try adding them to a lookup file which would be much easier.

Re: How do I convert a country name to country code (or vice versa)?

nick405060 — Thu, 23 Aug 2018 18:51:26 GMT

Yeah, that's what I ended up doing. Not super elegant but whatever. A moderator can convert your comment to an answer if they want. I just created country_codes.csv and then left joined my data with it.

<data> | join type=left Country [| search source="country_codes.csv" | table CC Country]

Re: How do I convert a country name to country code (or vice versa)?

niketn — Thu, 23 Aug 2018 19:12:15 GMT

@nick405060, I think you have implemented an incorrect approach for lookup file. You have indexed the lookup file instead of adding the same as Lookup file and creating Lookup Definition.

Refer to Splunk Documentation for Defining Lookup in Splunk. Once you have configured the same you can use lookup and inputlookup command to perform Country to Country Code and vice versa correlation depending on what is the field present in your data.

While the documentation links posted above have examples for each command. You can also search Splunk Answers for similar use cases. Following are couple of previous answers on similar lines:

https://answers.splunk.com/answers/132299/extracting-country-codes-from-phone-numbers.html
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

Re: How do I convert a country name to country code (or vice versa)?

nick405060 — Thu, 23 Aug 2018 19:33:10 GMT

Thanks! You're right, I could have used a lookup instead of indexing and joining.