topic Re: How to combine results of a search with a csv file in a table? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168312#M48000 <P>Is this working for you?</P> Thu, 30 Apr 2015 11:37:50 GMT vganjare 2015-04-30T11:37:50Z How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168305#M47993 <P>Hi there,</P> <P>I have a search that counts the appearance of an id. The first column is the id, the second is the count. I want a third column in that table, where the description for the id is listed. The description is now in a csv file. The first column in this file is the id, the second is the description. How can i compare the splunk search result and the csv file?<BR /> The result should look like this:</P> <P>ID | Description | count</P> <P>Thank you!!</P> <P>Chris</P> Wed, 29 Apr 2015 09:34:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168305#M47993 ChrisGermer 2015-04-29T09:34:22Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168306#M47994 <P>You can try using <STRONG>lookup</STRONG> command. More details @ <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup</A></P> <P>Thanks!!</P> Wed, 29 Apr 2015 09:52:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168306#M47994 vganjare 2015-04-29T09:52:26Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168307#M47995 <P>Hi vganjare,</P> <P>thanks for ur answer. I tried to use the lookup command. But i can not get it work <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>this is my search:</P> <PRE><CODE>sourcetype="DhcpSrvLog" | table msdhcp_id | lookup DhcpSrvLog_LOOKUP ID as msdhcp_id OUTPUT Description </CODE></PRE> <P>I get an error every time: Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table. <BR /> The csv file is uploded, and a lookup-definition is made. So, whats wrong? <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Wed, 29 Apr 2015 11:50:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168307#M47995 ChrisGermer 2015-04-29T11:50:11Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168308#M47996 <P>The column names are correctly and i get an output with:</P> <PRE><CODE>| inputlookup DhcpSrvLog_LOOKUP </CODE></PRE> Wed, 29 Apr 2015 11:53:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168308#M47996 ChrisGermer 2015-04-29T11:53:47Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168309#M47997 <P>Hi,</P> <P>Can you please provide the First two rows from the lookup. First row will have header names and second will have sample data.</P> <P>Thanks!!</P> Wed, 29 Apr 2015 11:58:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168309#M47997 vganjare 2015-04-29T11:58:20Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168310#M47998 <P>Ok, here it is:</P> <PRE><CODE>ID;Description 0;The log was started 1;The log was stopped </CODE></PRE> Wed, 29 Apr 2015 12:00:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168310#M47998 ChrisGermer 2015-04-29T12:00:04Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168311#M47999 <P>Hi,</P> <P>The lookup should be "comma seperated csv" file. In your lookup, <STRONG>;</STRONG> is causing the issues. If you change it to following, it will work.</P> <PRE><CODE> ID,Description 0,The log was started 1,The log was stopped </CODE></PRE> <P>Thanks!!</P> Wed, 29 Apr 2015 12:04:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168311#M47999 vganjare 2015-04-29T12:04:57Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168312#M48000 <P>Is this working for you?</P> Thu, 30 Apr 2015 11:37:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168312#M48000 vganjare 2015-04-30T11:37:50Z Re: How to combine results of a search with a csv file in a table? https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168313#M48001 <P>Hi there,<BR /> everything works fine with ur solution, thanks!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 04 May 2015 06:21:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-results-of-a-search-with-a-csv-file-in-a-table/m-p/168313#M48001 ChrisGermer 2015-05-04T06:21:01Z