Lookup using an indexed log file

faustf — Tue, 14 Feb 2017 11:22:59 GMT

Hi guys

I'm not an expert of Splunk.
I was wondering if I can use a lookup to reference fields that are stored into another log file (not csv) indexed in Splunk

Let me explain:
I have a log file indexed in Splunk:

col1,col2,GCD1,col4,col5
col1,col2,GCD2,col4,col5
col1,col2,GCD3,col4,col5

I've another file always indexed in Splunk:

graph [
    directed 1
    node [
        id 1
        Node "Node1"
    ]
    node [
        id 2
        Node "Node2"
    ]
    node [
        id 3
        Node "Node3"
    ]
]

I need a new field when I search for the first file that match the GDCID with the id in the second file

 col1,col2,GCD1,col4,col5,Node1
 col1,col2,GCD2,col4,col5,Node2
 col1,col2,GCD3,col4,col5,Node3

Is this possible?
Thanks

Re: Lookup using an indexed log file

martin_mueller — Tue, 14 Feb 2017 12:44:53 GMT

The general approach is something like this:

(search identifying data set 1) OR (search identifying data set 2) | stats values(field1) as field1 ... by common_field

The general assumption here is to have one event per "GCDn" on the left and one event per "id n" on the right, the stats stitches them together.

In your case you may need to do a bit of preprocessing, for example your first data set seems to have values like "GCD1" while the second data set appears to have values like "id 1" - those field values need to be harmonized before the stats, e.g. like this:

() OR () | eval common_field = case(expression identifying data set 1, replace(field_from_data_set_1, "GCD", ""), expression identifying data set 2, replace(field_from_data_set_1, "id ", ""), true(), "unknown id") | stats ...

More background: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html
Even more background: https://wiki.splunk.com/Virtual_.conf March 2016 talk "Best practices around grouping and aggregating data from different search results"

topic Lookup using an indexed log file in Splunk Search

Lookup using an indexed log file

Re: Lookup using an indexed log file