topic Re: Lookup on Calculated field in Splunk Search

Lookup on Calculated field

ChhayaV — Fri, 28 Jun 2013 09:29:02 GMT

Hi,
Is it possible to do lookup using a calculated field if yes then what is the procedure?
i tried doing it but not working for me may be i am missing something.

Thanks and Regards

Re: Lookup on Calculated field

MHibbin — Fri, 28 Jun 2013 10:40:52 GMT

Hi there,

I'm going to assume your calculated field is using stats or eval? - For a better answer, tailored to your issue, it is always best to show the search being used (even if some values are omitted for security reasons).

After you have your "calculated" fields, you may want to rename the fields to a simple format, e.g.

.. | rename count(somefield) AS countSomeField
OR
.. | rename "Some Crazily Formatted_Field(!&$(" AS someField

I have had some issues with fields not looking up properly, but worked once I changed the name being used. As I said to help us help you, please paste in your search and the header row of the CSV file please.

You can also check that Splunk has accepted your lookup configuration by running the following search (replacing the tag as to your needs):

| inputlookup <yourLookupName>

NOTE: The "|" (pipe) should be the first character typed as this is a special search command.

UPDATE: Based on your example...

So to clarify, your CSV has the following header:

pages,modulename

And you wish to link the pages field from your lookup to the extracted module field from your search (as you detailed it as Linkingfield) ? If so try the following:

host="hostname" 
| rex field=msg  "(GET:w+://[^)]+/(?<module>[^)]+.(xap|aspx))"
| lookup <yourLookupFile> page AS module OUTPUT modulename
| table _time host module modulename

You should check out the documentation also... http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources

Hope this helps,

Re: Lookup on Calculated field

ChhayaV — Fri, 28 Jun 2013 10:50:50 GMT

search
host="hostname" | rex field=msg "(GET:\w+://[^)]+/(?[^)]+.(xap|aspx))"

i want to do lookup on module field extracted in rex

fields in lookup file are
pages(linkingfield) and modulename

Re: Lookup on Calculated field

linu1988 — Fri, 28 Jun 2013 10:58:50 GMT

Yes Chayya, it's possible. But you need to mention a common field data for both the lookup table and output data from query.

Further you need to mention the lookup definition as |inputlookup will not work in the middle of the query. You will definitely get the output if the data matches the lookup table data, your case will workout very well.

Re: Lookup on Calculated field

MHibbin — Fri, 28 Jun 2013 11:07:49 GMT

That's not entirely true, you can reference fields when doing the lookup, e.g. someField AS someOtherField.

Re: Lookup on Calculated field

linu1988 — Fri, 28 Jun 2013 12:10:31 GMT

Agreed, edited my comment

Re: Lookup on Calculated field

MHibbin — Mon, 01 Jul 2013 08:24:15 GMT

That's cool.

Re: Lookup on Calculated field

ChhayaV — Tue, 02 Jul 2013 09:13:38 GMT

Hi,
I want to restrict my regex to first match how can i do that?