https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253519#M75861 <P>Learn something new everyday <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Please close out the question by accepting the answer.</P> Mon, 29 Aug 2016 17:44:38 GMT sundareshr 2016-08-29T17:44:38Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253514#M75856 <P>I am trying to match the fields countrycode (An eval field extracted from indexed data) with a field "Code" in a CSV file, get the corresponding "branch_name" from the CSV, and display it along with certain fields that are indexed. Here is my current search:</P> <PRE><CODE>inputcsv sample_csv.csv [ search index="logs" | eval country_code=substr(server_name,3,3) | table country_code ] | eval Branch=if(Code,country_code,Branch_name) | table Branch, ... </CODE></PRE> <P>But it is not working. </P> Mon, 29 Aug 2016 17:17:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253514#M75856 sushmitha_mj 2016-08-29T17:17:31Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253515#M75857 <P>Have you considered using Lookups? How frequently does your csv file change?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Lookup</A></P> Mon, 29 Aug 2016 17:20:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253515#M75857 sundareshr 2016-08-29T17:20:02Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253516#M75858 <P>The CSV does not change. I did not consider using a lookup. Is that the only option. Can I not do it with a simple query connecting the two sources? </P> Mon, 29 Aug 2016 17:21:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253516#M75858 sushmitha_mj 2016-08-29T17:21:42Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253517#M75859 <P>Lookup table is your best option, but if you choose not to use lookups, try this (i have never used this)</P> <PRE><CODE> index="logs" | eval country_code=substr(server_name,3,3) | append [inputcsv sample_csv.csv |rename Code as country_code ] | stats values(Branch_Name) as Branch_name by country_code </CODE></PRE> Mon, 29 Aug 2016 17:34:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253517#M75859 sundareshr 2016-08-29T17:34:17Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253518#M75860 <P>It actually works <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> <BR /> I also created a lookup table (Just added the csv files as a lookup table). Just curious, how can I extract the same info using the lookup table? </P> <P>I checked the doc you sent me, but I did not get it. </P> Mon, 29 Aug 2016 17:43:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253518#M75860 sushmitha_mj 2016-08-29T17:43:37Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253519#M75861 <P>Learn something new everyday <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Please close out the question by accepting the answer.</P> Mon, 29 Aug 2016 17:44:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253519#M75861 sundareshr 2016-08-29T17:44:38Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253520#M75862 <P>For lookup table, here are the steps</P> <P>1) Create lookup table. Set appropriate permissions (app level,maybe)<BR /> 2) Create lookup definition. Set appropriate permissions (app level,maybe)<BR /> 3) Use in search, like this</P> <PRE><CODE>index=logs | eval code=substr(server_name,3,3) | lookup lookupfiledefinitonname Code as code OUTPUT Branch_name | rest of your query </CODE></PRE> Mon, 29 Aug 2016 17:47:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253520#M75862 sundareshr 2016-08-29T17:47:39Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253521#M75863 <P>Awesome.. thanks </P> Tue, 30 Aug 2016 13:37:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253521#M75863 sushmitha_mj 2016-08-30T13:37:23Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253522#M75864 <P>Hey @sundareshr <BR /> I have been using the above query, it is working, I wanted to add a couple of more fields to the result set like Server_name, type etc. These fields are present in the indexed data . But when I add those fields the result set is giving me all the fields in the csv and not restricting the result set to the time filter. How can I enhance the query ? </P> Fri, 16 Sep 2016 20:09:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253522#M75864 sushmitha_mj 2016-09-16T20:09:42Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253523#M75865 <P>For using time as a filter, you have to configure your lookup as time-based lookup</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Configureatime-boundedlookup">https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Configureatime-boundedlookup</A></P> Fri, 16 Sep 2016 20:27:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-fields-from-indexed-data-with-a/m-p/253523#M75865 sundareshr 2016-09-16T20:27:13Z