https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106935#M27822 <P>Ah good to know about the sequence they are run. Thanks</P> Fri, 26 Apr 2013 02:53:18 GMT phoenixdigital 2013-04-26T02:53:18Z https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106930#M27817 <P>I have some data in Splunk that I would like to link to some external CSV files </P> <P>Splunk events have this format</P> <PRE><CODE>_time, data, link1 </CODE></PRE> <P>The first CSV will be a time based lookup based on link1</P> <PRE><CODE>dd/mm/yyyy, link1, link2, link3, data2, data3 </CODE></PRE> <P>The second CSV file will be another time based lookup but using data from first CSV to link (link2, link3)</P> <PRE><CODE>dd/mm/yyyy, link2, link3, data4, data5 </CODE></PRE> <P>So I have have successfully linked the first CSV via this method<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-based_fields_lookup">http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-based_fields_lookup</A></P> <P>What I want to know is if these lookups are cumulative?</P> <P>ie will the second temporal lookup allow the use of results linked from the first lookup?</P> <P>Or should I just go down the external script lookup route?</P> Fri, 26 Apr 2013 01:28:27 GMT https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106930#M27817 phoenixdigital 2013-04-26T01:28:27Z https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106931#M27818 <P>I just did a test and it doesnt appear to work. But any suggestion on how to achieve this would be great.</P> Fri, 26 Apr 2013 01:59:53 GMT https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106931#M27818 phoenixdigital 2013-04-26T01:59:53Z https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106932#M27819 <P>Scratch that is was an issue with my props.conf</P> <P>IT WORKS!</P> Fri, 26 Apr 2013 02:19:25 GMT https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106932#M27819 phoenixdigital 2013-04-26T02:19:25Z https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106933#M27820 <P>Yes, they will run in sequence. The order is determined by the lexicographic order, so that LOOKUP-a will run before LOOKUP-b.</P> Fri, 26 Apr 2013 02:50:38 GMT https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106933#M27820 gkanapathy 2013-04-26T02:50:38Z https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106934#M27821 <P>Just posting the solution here in case someone else wants to know how it is done</P> <P><STRONG>transforms.conf</STRONG></P> <PRE><CODE>[customerLookup] filename=customer-details.csv time_field=contract_start time_format = %d/%m/%Y [chargesLookup] filename=charges.csv time_field=date time_format = %d/%m/%Y </CODE></PRE> <P><STRONG>props.conf</STRONG></P> <PRE><CODE>[usage-data] LOOKUP-customerCSV = customerLookup link1 OUTPUT link2 link3 data2 data3 LOOKUP-injectionChargesCSV = chargesLookup link2 link3 OUTPUT data4 data5 </CODE></PRE> <P>It works perfectly so its good to know this is possible.</P> Fri, 26 Apr 2013 02:52:37 GMT https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106934#M27821 phoenixdigital 2013-04-26T02:52:37Z https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106935#M27822 <P>Ah good to know about the sequence they are run. Thanks</P> Fri, 26 Apr 2013 02:53:18 GMT https://community.splunk.com/t5/Splunk-Search/Cumulative-time-based-temporal-lookups-possible/m-p/106935#M27822 phoenixdigital 2013-04-26T02:53:18Z