topic Re: Lookup search query results to null in Splunk Search

Lookup search query results to null

SasiB137 — Mon, 28 Sep 2020 20:18:36 GMT

csv file users_timeout_value_map.csv content.
TIMEOUT,TIMEOUT_VAL

default_timeout,300

transformes.conf

[users_timeout_value_lookup]
filename = users_timeout_value_map.csv
Question
... | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

This always results 1800 as TIMEOUT results to null. Can any one help me plz.

Thanks,
Sasi.

Re: Lookup search query results to null

richgalloway — Wed, 17 Jun 2015 03:05:11 GMT

What do you get from ... | table TIMEOUT TIMEOUT_VAL TIMEOUT_VALUE ?

Re: Lookup search query results to null

lguinn2 — Wed, 17 Jun 2015 04:48:33 GMT

First, the file name is transforms.conf not transformers.conf, but that is probably just a typo.

Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.

If your search results return a field with a different name, then you can use

| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL

to tell Splunk which field to match against the TIMEOUT field of the CSV file.

Re: Lookup search query results to null

chimell — Wed, 17 Jun 2015 07:55:17 GMT

Hi SasiB137
Make sure that TIMEOUT_VAL field is present in the list of your field and that it is a numeric field

Re: Lookup search query results to null

SasiB137 — Mon, 28 Sep 2020 20:18:41 GMT

this works :
...| eval TIMEOUT="default_timeout" | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT_VAL),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

Re: Lookup search query results to null

SasiB137 — Wed, 17 Jun 2015 16:22:13 GMT

null null 1800