topic Re: How to get column from csv file to insert in search result in Splunk Search

How to get column from csv file to insert in search result?

Julia1231 — Fri, 23 Sep 2022 15:39:16 GMT

Hi everyone,

I use dbxquery and get this result from database:

id	count
123	12
456	24
478	6

Also I have a csv file already put in lookup of Splunk like this:

id	type
123	Machine
478	Machine
456	Food
987	Food
789	Toys

Please, how can I insert the column "type" from lookup to the search result above?

Basically this is what I want to achieve:

id	count	type
123	12	Machine
478	6	Machine
456	24	Food
987	0	Food
789	0	Toys

I tried: |lookup lookupfile.csv id OUTPUT id type but it doesn't work

Thanks,

Julia

Re: How to get column from csv file to insert in search result

richgalloway — Fri, 23 Sep 2022 13:06:33 GMT

Your lookup command should have worked, but try this one.

| lookup lookupfile.csv id OUTPUT type

If that doesn't produce the desired results then please show or explain the results you do get. "it doesn't work" isn't very helpful.

Re: How to get column from csv file to insert in search result

yuanliu — Sat, 24 Sep 2022 21:40:03 GMT

I agree that "doesn't work" is not informative and should be avoided in any description.

Additionally, when you "put in lookup of Splunk," did you make a lookup definition? (In addition to upload the CSV file.) Did you name that definition as "lookupfile.csv" or something else? (I usually name my lookups "lookupfile" instead of "lookupfile.csv".)

Re: How to get column from csv file to insert in search result?

Julia1231 — Mon, 26 Sep 2022 09:31:12 GMT

Hi @yuanliu @richgalloway ,

Sorry for not making it clear for the "it doesn't work". I meant nothing change in the result search.

Anw, by the end I found the reason, cause I forgot that Splunk cares the case sensitive. In the csv, I put "ID", but in splunk it's "id"

Have a nice day!