topic Re: Question on how to use lookup file in Splunk Search

Question on how to use lookup file

Deepz2612 — Wed, 30 Sep 2020 02:45:04 GMT

I have a lookup file which has below 3 columns.

Exception_Name Exception_Keyword Comments
REXC RemoteException Alerted
JNEXC Exception-NullPointer Ignorable

Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also.
And if the Exception_Keyword does not exists in lookup it should be listed as New..

Expected output as below :

Exception Name Host Count Comments
REXC ABC 27 Alerted
javanull ABC 3 New

Kindly help please.
Thanks!

Re: Question on how to use lookup file

woodcock — Fri, 25 Oct 2019 07:43:23 GMT

Like this:

Your Search Here That Generates Exception_Name Exception_Keyword Comments columns
| lookup YourLookupHere.csv
| fillnull value="New" Comments

Re: Question on how to use lookup file

gcusello — Fri, 25 Oct 2019 10:11:17 GMT

Hi Deepz2612,
it should be near your request:

index=your_index
| rename _raw as rawText
| eval pattern=[ 
    | inputlookup exceptions.csv
    | stats values(Exception_Keyword) AS query
    | eval query=mvjoin(query,",")
    | fields query
    | format "" "" "" "" "" ""
    ]
| eval pattern=split(pattern,",")
| mvexpand pattern
| eval pattern="%".pattern."%"
| eval check=if(like(rawText,pattern),pattern,"No")
| rex field=pattern "\%(?<pattern>[^\%]*)\%"
| lookup exceptions.csv Exception_Keyword AS pattern OUTPUT Exception_Name Comments
| fillnull value="New" Comments
| stats values(Comments) AS Comments count BY Exception_Name host

Ciao.
Giuseppe