https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88670#M22703 <P>There are multiple options, and what suits you depends entirely on what specifically you're trying to do. Could you explain your scenario more in detail?</P> Wed, 16 Jan 2013 08:51:53 GMT Ayn 2013-01-16T08:51:53Z https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88669#M22702 <P>I have a bunch of fields, let's say Field A, Field B, Field C.</P> <P>I want to give each field a certain value.<BR /> For example, Field A has value of 2<BR /> Field B has value of 1<BR /> Field C has value of 2</P> <P>How should I give Splunk this information?<BR /> Should it be in a separate lookup table or just in an addional row in my CSV file?</P> <P>If so, how can I search and only show fields with a certain value</P> Wed, 16 Jan 2013 00:19:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88669#M22702 cmak 2013-01-16T00:19:20Z https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88670#M22703 <P>There are multiple options, and what suits you depends entirely on what specifically you're trying to do. Could you explain your scenario more in detail?</P> Wed, 16 Jan 2013 08:51:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88670#M22703 Ayn 2013-01-16T08:51:53Z https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88671#M22704 <P>I'm going to take a punt and say you're after an automatic lookup, what you mean by "an additional row in my CSV file?" is a bit beyond us as you haven't mentioned an existing CSV file <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>In this case I would put it into a lookup such as;</P> <PRE><CODE>values.csv Field, Value A,2 B,1 C,2 </CODE></PRE> <P>I would then create an automatic lookup in my props.conf for that sourcetype;</P> <PRE><CODE>[MYAMAZINGSOURCETYPE] LOOKUP-values = valuescsv Field OUTPUT Value </CODE></PRE> <P>In transforms.conf I would define the lookup...</P> <PRE><CODE>[valuescsv] filename = values.csv </CODE></PRE> <P>Finally, you need to take into consideration how the Field value is extracted, presumably this is already handled in your instance but you need to make sure that is extracted BEFORE the automatic lookup.</P> <P>Otherwise, you can now run a search on that sourcetype for a Value=2 to only see those values.</P> Wed, 16 Jan 2013 09:12:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88671#M22704 Drainy 2013-01-16T09:12:16Z https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88672#M22705 <P>I have many Fields</P> <P>Field A, FieldB, Field C, Field D<BR /> They each have a weight associated with them.<BR /> FieldA : 0<BR /> FieldB : 1<BR /> FieldC : 0<BR /> FieldD : 1</P> <P>I tried using a lookup table to associate the field with a weight but I cannot seem to be able to do so.</P> <P>I would like to do queries like:<BR /> Just show the fields in the table with weight of 0.<BR /> Then only Field A and Field C would show.</P> Thu, 17 Jan 2013 19:07:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-each-field-Additional-Information-and-use-this-in-a/m-p/88672#M22705 cmak 2013-01-17T19:07:26Z