https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482165#M135089 <P>Create 2 lookup tables . One for color (color.csv) and other for Planets (Planets.csv)</P> <P>Planets.csv will have fields -fields1 , planet<BR /> color.csv will have fields - field2, color</P> <P>base query<BR /> | lookup Planets.csv fields1 <BR /> |lookup color.csv fields2 <BR /> | table fields1,planet,fields2,color.</P> Tue, 17 Sep 2019 16:41:54 GMT Anantha123 2019-09-17T16:41:54Z https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482163#M135087 <P>My event log has comma separated field values of 100+ fields. Each field can have about 2-15 different values. Example if field10=3, I need to map to earth, field10=4, map to mars so on. If field11=4, map to blue, field11=5, map to red and so on. Please help with an example format of lookup csv and how to use it in the search bar so the searched events in the output show with the mapped values. thank you</P> <P>mylookup.csv<BR /> .<BR /> field1,1=mercury,2=venus,3=earth<BR /> field2,1=brown,2=blue,3=red,4=yellow,5=green</P> <P>my basic search gives <BR /> 3,2,a,b,c..<BR /> how to get output like<BR /> earth,blue,x,y,z....<BR /> or<BR /> 3_earth,2_blue,p_x,q_y,r_z....</P> Wed, 30 Sep 2020 02:12:13 GMT https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482163#M135087 smiththebest 2020-09-30T02:12:13Z https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482164#M135088 <P>What's your basic search? Is your lookup table has headers?</P> Sun, 15 Sep 2019 14:59:18 GMT https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482164#M135088 jawaharas 2019-09-15T14:59:18Z https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482165#M135089 <P>Create 2 lookup tables . One for color (color.csv) and other for Planets (Planets.csv)</P> <P>Planets.csv will have fields -fields1 , planet<BR /> color.csv will have fields - field2, color</P> <P>base query<BR /> | lookup Planets.csv fields1 <BR /> |lookup color.csv fields2 <BR /> | table fields1,planet,fields2,color.</P> Tue, 17 Sep 2019 16:41:54 GMT https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482165#M135089 Anantha123 2019-09-17T16:41:54Z https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482166#M135090 <P>Thank you, my issue is there are about 50 + useful fields out of 250 odd total fields, this means my lookup need to be 50 files. I think it is better to do just replace command in search for the value in fields?</P> Mon, 30 Sep 2019 08:12:51 GMT https://community.splunk.com/t5/Splunk-Search/please-help-on-how-to-achieve-the-below-kind-of-lookup-rename/m-p/482166#M135090 smiththebest 2019-09-30T08:12:51Z