topic Re: Display data in Splunk Search

Display data

palisetty — Fri, 27 Dec 2019 09:21:42 GMT

How would I display the following data which is part of CSV file? I am looking for a command to do that. top is not working, I can't think of other commands to display
Code Description
200 Success
503 Service unavailable
406 Not Acceptable Client
400 Bad Request Error
408 Request Timeout
500 Internal Server Error
404 Page Not Found
505
403

I want blank values for 505 and 403 to be displayed so that I can try fillnull command.

Re: Display data

palisetty — Fri, 27 Dec 2019 09:33:12 GMT

@gcusello any help please

Re: Display data

vnravikumar — Fri, 27 Dec 2019 09:50:56 GMT

Whether that file is part of lookup, if so try with inputlookup or lookup commands

Re: Display data

palisetty — Fri, 27 Dec 2019 09:54:01 GMT

Ravi, they are not part of lookup. any simple commands would do? I will try to display from lookup too

Re: Display data

to4kawa — Fri, 27 Dec 2019 13:35:24 GMT

If you are looking for answers to the exam, ask such questions.
You mentioned in the video, right?

Transforming command

Re: Display data

gcusello — Wed, 30 Sep 2020 03:26:33 GMT

Hi @palisetty,
thanks you for your estimate!

Anyway the solution is the one hinted by @vnravikumar: if you already have loaded your csv in a lookup (called e.g. ws_codes.csv) you can use it in three ways using two commands inputlookup and lookup:

to list the lookup values you can use | inputlookup ws_codes.csv;
to filter search results with the content of the lookup you can use index=my_index [ | inputlookup ws_codes.csv | fields Code] | ...;
to enrich a search result with the content of the lookup, adding e.g. Description that isn't present in the search result:

index=my_index
| lookup ws_codes.csv Code AS your_Code_field OUTPUT Description
| table _time my_fields Cods Description
You can find infos on these commands at https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Inputlookup and https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Lookup .

If instead you still haven't loaded the csv in the lookup you have to follow two ways:

Use Lookup Editor app (the easiest!);
create a new lookup in [Settings -- Lookups -- Lookup table files-- Add new].

In both cases, remember to create a Lookup Definition [Settings -- Lookups -- Lookup definition -- Add new].

Ciao and Happy New Year.
Giuseppe

Re: Display data

palisetty — Sat, 28 Dec 2019 06:09:24 GMT

@gcusello Actually, I didn't want to use lookup.
I am so stupid but later figured it how simple it is.
Just upload the file as I am an Administrator on my machine. Then use head or table commands. then use fillnull value=whatevervalue.

Thank you again. Hope you had a wonderful Christmas

Re: Display data

woodcock — Sat, 28 Dec 2019 23:57:29 GMT

Like this?

| inputlookup YourLookupFileNameHere.csv
| stats values(*) AS * BY Code Description
| fillnull Description value="UNKNOWN"