topic Re: can I give a description to an extracted field? in Splunk Search

can I give a description to an extracted field?

rileyken — Mon, 29 Jul 2019 19:21:53 GMT

I have a GUID field in my logs, and the guid is unique for a specific location. I wanted to query for all events that happen at a specific location so I have to look up the guid value for the location and then search for the guid. Is it possible to use the friendly name for the location to search by instead?

Re: can I give a description to an extracted field?

jacobpevans — Mon, 29 Jul 2019 19:33:50 GMT

Greetings Riley,

Settings > Lookups > "Add New" next to "Lookup table files"
Create a CSV similar to the one below. Upload it with name "GUIDs.csv"
Run the search below in the same app that the csv was uploaded in.

GUIDs.csv

GUID,Description
 1,Location 1
 2,Location 2
 3,Location 3
 4,Location 4
 5,Location 5
 6,Location 6
 7,Location 7
 8,Location 8
 9,Location 9
 10,Location 10

Query

| makeresults count=10
| eval   GUID=random()%10
| lookup GUIDs.csv GUID as GUID
| search Description IN ("Location 1", "Location 2", "Location 3")

If anyone in the future finds this post useful, please refer to this link https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

Re: can I give a description to an extracted field?

rileyken — Tue, 30 Jul 2019 12:45:49 GMT

Thanks, worked like a champ!

Re: can I give a description to an extracted field?

jacobpevans — Tue, 30 Jul 2019 13:08:09 GMT

You're welcome!