topic Re: Append a lookup value from csv to a chart table in Splunk Search

Append a lookup value from csv to a chart table

Topher22 — Thu, 10 Oct 2024 14:08:07 GMT

I am looking to append a value in a lookup csv to an existing search

index=* |fields _time,x |chart count(_raw) by X

and I want to replace(or append) the X with a value(name) from a csv so I can table the results.

Re: Append a lookup value from csv to a chart table

gcusello — Thu, 10 Oct 2024 06:13:13 GMT

Hi @Topher22 ,

you can append or replace a value , as you would, simply using the lookup command:

if in the lookup the field to replace is Y and must be related to X from the main search and you want to use the value X_descrition from the lookup, you can use something like this:

index=* | lookup my-lookup.csv Y AS X OUTPUT X_description | chart count(_raw) by X_description

You can find more infos about the lookup command at https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup

Ciao.

Giuseppe

Re: Append a lookup value from csv to a chart table

yuanliu — Fri, 11 Oct 2024 03:29:09 GMT

If you have lots of events, performing lookup after stats will be more efficient.

index=* | chart count by X | lookup my-lookup.csv Y AS X OUTPUT X_description

This will add an extra field. If you don't want to see X, just remove it with fields command.