Lookup against an Array

gbam — Fri, 10 Nov 2023 17:57:36 GMT

I'm trying to run a lookup against a list of values in an array. I have a CSV which look as follows:

id	x	y
123	Data	Data2
321	Data	Data2
456	Data3	Data3

The field from the search is is an array which looks as follows:

["123", "321", 456"]

I want to map the lookup value. Do I need to iterate over the field or can I use a lookup or is the best option?

Re: Lookup against an Array

tscroggins — Sat, 11 Nov 2023 13:04:17 GMT

Hi @gbam,

Splunk provides an eval function, json_array_to_mv, to convert JSON-like array values to multivalued field values. After conversion, you can use the lookup command just as you would for any other field:

| makeresults | eval id="[\"123\", \"321\", \"456\"]" | eval id=json_array_to_mv(id, false()) | lookup gbam_lookup.csv id

_time	id	x	y
2023-11-10 16:14:53	123 321 456	Data Data Data3	Data2 Data2 Data3

Index 0 of multivalued field id corresponds to index 0 of multivalued fields x and y, index 1 corresponds to index 1, etc.

topic Lookup against an Array in Splunk Search

Lookup against an Array

Re: Lookup against an Array