https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483560#M135380 <P>Hi all, i have used csv lookup file to csv files to map the values . Can i use json file instead of csv file to map the values from the csv lookup file? </P> Thu, 27 Feb 2020 09:35:44 GMT anooshac 2020-02-27T09:35:44Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483560#M135380 <P>Hi all, i have used csv lookup file to csv files to map the values . Can i use json file instead of csv file to map the values from the csv lookup file? </P> Thu, 27 Feb 2020 09:35:44 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483560#M135380 anooshac 2020-02-27T09:35:44Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483561#M135381 <P>No, not directly. Lookup FILES only work with CSV files.</P> <P>You may be able to implement an external lookup with a script which parses your JSON data and returns matched values, but you would need to build this yourself.</P> <P>Alternativly, you could write the JSON data into the KV store and use a KV lookup instead.<BR /> There are a couple of approaches for this, but if the json file is updated frequently, you may just be better finding a repeatable way to convert the json data to CSV.</P> Thu, 27 Feb 2020 09:40:24 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483561#M135381 nickhills 2020-02-27T09:40:24Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483562#M135382 <P>Thank you @nickhillscpl , i am yet to explore about these things. Can you please suggest some links to understand these things in a better way.</P> Thu, 27 Feb 2020 11:05:28 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483562#M135382 anooshac 2020-02-27T11:05:28Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483563#M135383 <PRE><CODE>|makeresults | eval _raw="your_json" | spath | rename JSON_NESTED_FIELD_NAME AS Clean_Name | outputcsv your.csv </CODE></PRE> Thu, 27 Feb 2020 11:09:50 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483563#M135383 to4kawa 2020-02-27T11:09:50Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483564#M135384 <P>@to4kawa read my mind <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> <BR /> This would also work if you are already indexing the json file (or can).</P> <P>You could even use this approach to populate a kv lookup using <CODE>|outputlookup</CODE> </P> Thu, 27 Feb 2020 11:15:19 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483564#M135384 nickhills 2020-02-27T11:15:19Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483565#M135385 <P>CSV Lookups: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usefieldlookupstoaddinformationtoyourevents">https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usefieldlookupstoaddinformationtoyourevents</A></P> <P>External Lookups: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineanexternallookupinSplunkWeb">https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineanexternallookupinSplunkWeb</A></P> <P>KV Lookups: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineaKVStorelookupinSplunkWeb">https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineaKVStorelookupinSplunkWeb</A></P> <P>Good luck!</P> Thu, 27 Feb 2020 11:16:57 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-use-json-file-with-csv-lookup-file/m-p/483565#M135385 nickhills 2020-02-27T11:16:57Z