https://community.splunk.com/t5/Splunk-Search/Lookup-full-text-of-Cisco-event-and-display-in-new-window/m-p/38825#M8854 <P>I have a search time field extraction for CISCO system messages named MsgClassID. I uploaded from Manager a CISCOevt_codes.csv table. Given that the table format looks like this:</P> <PRE><CODE> error_code,event_desc,log_level,log_level_desc 101001,(Primary) Failover cable OK,1,alert </CODE></PRE> <P>I would like to do a discretionary lookup from the MsgClassID field pulldown and using the value of MsgClassID against error_code, I would like to return the full discription for the event in a new window.</P> <P>Haven't been able to find any examples ... Is it possible to do ?</P> Sat, 28 Aug 2010 00:47:04 GMT MikeyG 2010-08-28T00:47:04Z https://community.splunk.com/t5/Splunk-Search/Lookup-full-text-of-Cisco-event-and-display-in-new-window/m-p/38825#M8854 <P>I have a search time field extraction for CISCO system messages named MsgClassID. I uploaded from Manager a CISCOevt_codes.csv table. Given that the table format looks like this:</P> <PRE><CODE> error_code,event_desc,log_level,log_level_desc 101001,(Primary) Failover cable OK,1,alert </CODE></PRE> <P>I would like to do a discretionary lookup from the MsgClassID field pulldown and using the value of MsgClassID against error_code, I would like to return the full discription for the event in a new window.</P> <P>Haven't been able to find any examples ... Is it possible to do ?</P> Sat, 28 Aug 2010 00:47:04 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-full-text-of-Cisco-event-and-display-in-new-window/m-p/38825#M8854 MikeyG 2010-08-28T00:47:04Z https://community.splunk.com/t5/Splunk-Search/Lookup-full-text-of-Cisco-event-and-display-in-new-window/m-p/38826#M8855 <P>Sure. That sounds like you want a basic "workflow action" (what used to be simply called "field action"):</P> <P><A href="http://www.splunk.com/base/Documentation/4.1.4/Knowledge/CreateworkflowactionsinSplunkWeb" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.4/Knowledge/CreateworkflowactionsinSplunkWeb</A></P> Sun, 29 Aug 2010 01:24:28 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-full-text-of-Cisco-event-and-display-in-new-window/m-p/38826#M8855 gkanapathy 2010-08-29T01:24:28Z