topic Re: Is it possible to do a lookup based on IF statement? in Splunk Search

Is it possible to do a lookup based on IF statement?

guimilare — Wed, 24 Jan 2018 16:43:34 GMT

Hello Splunkers,
here is my scenario:

I have a field actionType that can assume two values: "S" or "A".
Based on actionType value, I need to do a lookup in different lookup tables.

For example, if actionType is "S", I have to do a lookup with S_actions.csv table; if it is "A", I have to do a lookup with A_actions.csv table.

My first idea was using an if statement, but I was unable to do so.
Any Ideas?

Thank in advance!

Re: Is it possible to do a lookup based on IF statement?

493669 — Wed, 24 Jan 2018 16:48:30 GMT

on selection of action type as "S" or "A", what action needs to be performed on lookup?

Re: Is it possible to do a lookup based on IF statement?

guimilare — Wed, 24 Jan 2018 16:52:54 GMT

I'll use a second field called "Action" (that's a code, and can be multivalue) and get the action description using the lookup.
Both S and A actionTypes have similar codes (e.g: A1, A2, A3). That's why I need to separate the lookups.

Re: Is it possible to do a lookup based on IF statement?

elliotproebstel — Wed, 24 Jan 2018 17:43:15 GMT

I'd do it like this:

your base search 
| eval s_action=if(actionType="S", Action, NULL), a_action=if(actionType="A", Action, NULL
| lookup S_actions.csv action AS s_action
| lookup A_actions.csv action AS a_action
| fields - s_action a_action

Re: Is it possible to do a lookup based on IF statement?

guimilare — Wed, 24 Jan 2018 17:54:45 GMT

Thanks! Exactly what I needed!

Re: Is it possible to do a lookup based on IF statement?

elliotproebstel — Wed, 24 Jan 2018 18:05:22 GMT

Glad to help. 🙂