topic Re: Mapping id and name from lookup csv in Splunk Search

Mapping id and name from lookup csv

alanhodreamshub — Mon, 01 Nov 2021 04:51:26 GMT

Hello experts,

My splunk search can return only a list of group IDs, but group names can only be found separately

there is a groups.csv file which maps id and name

groupid,groupname,
"a1234", "apple",
"b2345","balloons",
"c1144","cats"

How can I write the query to return group id and the corresponding group name

index=myidx type=groups
| table _time groupid groupname

Thanks a lot!

Re: Mapping id and name from lookup csv

jwalthour — Mon, 01 Nov 2021 05:17:06 GMT

How about:

index=myidx type=groups
| lookup groups.csv groupid OUTPUTNEW groupname
| table _time groupid groupname

Re: Mapping id and name from lookup csv

vhharanpositka — Mon, 01 Nov 2021 05:20:18 GMT

Hi @alanhodreamshub

You have to include the lookup life in the search for mapping the id and name.

Try this one

Search:

index=myidx type=groups | lookup groups.csv groupid OUTPUT groupname
| table _time groupid groupname

Re: Mapping id and name from lookup csv

alanhodreamshub — Mon, 01 Nov 2021 07:36:01 GMT

my bad, i should be more precise.

index=myidx type=groups
| table _time request.groupid groupname

this will return:

_time	request.groupid	groupname
2021-11-01 15:33	"a1234"
2021-11-01 15:33	"b2345"
2021-11-01 15:33	"c1144"

groups.csv:

groupid,groupname,
"a1234", "apple",
"b2345","balloons",
"c1144","cats"

How can i map request.groupid with the groupname (associated to groupid) in groups.csv

Re: Mapping id and name from lookup csv

jwalthour — Mon, 01 Nov 2021 11:24:50 GMT

Try this:

index=myidx type=groups
| lookup groups.csv groupid AS ‘request.groupid’ OUTPUTNEW groupname
| table _time request.groupid groupname

Re: Mapping id and name from lookup csv

alanhodreamshub — Tue, 02 Nov 2021 04:07:57 GMT

Thanks!