https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152652#M42762 <P>Follow below steps</P> <P>Step 1: Add CSV file containing columns <CODE>Brand_ID, Brand_Name</CODE> under lookups folder</P> <P>Step 2: Add a Stanza in your transforms.conf file like this<BR /> [csv_brand_info]<BR /> filename = brand_info.csv<BR /> max_matches = 1<BR /> case_sensitive_match = false</P> <P>Step 3: Write search to include lookup like this</P> <PRE><CODE>your search.. | stats count as Count by brand_id | lookup csv_brand_info Brand_ID as brand_id OUTPUT Brand_ID Brand_Name | table Brand_ID Brand_Name Count </CODE></PRE> Mon, 28 Sep 2020 17:08:20 GMT strive 2020-09-28T17:08:20Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152650#M42760 <P>We have indexed csv file and it has field brand_id, can you please provide steps how to lookup this brand_id field equivalent to brand_name using automatic lookup in the output.</P> <P>Input data (csv) :</P> <P>brand_id,field1,field2,field3<BR /> 1,11,111,1111<BR /> 2,22,222,2222<BR /> 3,33,333,3333<BR /> 1,22,222,2222<BR /> 2,11,111,1111<BR /> 1,11,111,1111</P> <P>Required output (brandwise stats count):</P> <P>brand_id,brand_name,count<BR /> 1,xyz,3<BR /> 2,abc,2<BR /> 3,pqr,1</P> Mon, 28 Sep 2020 17:08:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152650#M42760 dhavamanis 2020-09-28T17:08:15Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152651#M42761 <P>Provided you have already configured a lookup table file with fields "brand_id" and "brand_name", with name say brandlookup.csv, then try this</P> <PRE><CODE>index=yourindex source=yourcsvfile | stats count by brand_id | lookup brandlookup.csv brand_id OUTPUT brand_name | table brand_id, brand_name, count </CODE></PRE> Mon, 28 Sep 2020 17:08:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152651#M42761 somesoni2 2020-09-28T17:08:18Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152652#M42762 <P>Follow below steps</P> <P>Step 1: Add CSV file containing columns <CODE>Brand_ID, Brand_Name</CODE> under lookups folder</P> <P>Step 2: Add a Stanza in your transforms.conf file like this<BR /> [csv_brand_info]<BR /> filename = brand_info.csv<BR /> max_matches = 1<BR /> case_sensitive_match = false</P> <P>Step 3: Write search to include lookup like this</P> <PRE><CODE>your search.. | stats count as Count by brand_id | lookup csv_brand_info Brand_ID as brand_id OUTPUT Brand_ID Brand_Name | table Brand_ID Brand_Name Count </CODE></PRE> Mon, 28 Sep 2020 17:08:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152652#M42762 strive 2020-09-28T17:08:20Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152653#M42763 <P>Thanks if we try this,</P> <P>index="idxmember" | stats count by brand_id | lookup lufile_brandid_brandname.csv BRAND_ID OUTPUT BRAND_NAME | table brand_id, BRAND_NAME, count</P> <P>we are not getting the BRAND_NAME in the output.</P> Mon, 28 Sep 2020 17:08:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152653#M42763 dhavamanis 2020-09-28T17:08:23Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152654#M42764 <P>The case of the field name matters. If the field name is 'brand_id' , use the same during lookup. (I see the case is different for brand_id, also ensure case for brand_name)</P> Mon, 28 Sep 2020 17:08:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-field-from-csv-file-using-automatic-lookups/m-p/152654#M42764 somesoni2 2020-09-28T17:08:26Z