topic Re: Populating Additional Information on Field Data in Splunk Search

Populating Additional Information on Field Data

chrisschum — Thu, 08 Mar 2018 13:20:21 GMT

I'm getting log data from a system that uses codes for each entry and I'd like to replace or add a description of the code to my results. There's a big list of codes for the system so I was wondering how I can do that.

Example:
The system logs that User A performed Code A on a user account
The system logs that User B performed Code B on a user account

Code A = User password change
Code B = User address change

Expected results in Splunk search:
User A performed Code A "User password change"
User B performed Code B "User address change"

Thanks!

Re: Populating Additional Information on Field Data

chrisschum — Thu, 08 Mar 2018 14:02:37 GMT

Also, it may not have been clear above but I would like to have a list of the codes and their values and have that list checked when a search is done so that a description of the code populates in the search.

Re: Populating Additional Information on Field Data

richgalloway — Thu, 08 Mar 2018 14:03:22 GMT

This is what lookups are for. Create a CSV file ("codes.csv") with your codes and descriptions like this:

Code, Description
A, User password change
B, User address change

Then use the lookup command to get the description from the file at search time.

<your base search> | lookup codes.csv Code OUTPUT Description | table User Code Description

Re: Populating Additional Information on Field Data

chrisschum — Thu, 08 Mar 2018 14:05:44 GMT

Perfect! Thanks!