Hi Splunk Experts,
I have 2 files
File1:
Filer_Name Dept Volume_Name Vol_Total Vol_Used
Abcd Vol1 100 50
File 2:
Filer_Name Dept Volume_Name Vol_Total Vol_Used
Abcd IT Vol1
File 1 is generated by storage monitoring script and file 2 is maintained manually with Dept name.
What I want to do is, I want to concatenate “Filer_Name
” and “Volume_Name
” in both files and based on the value lookup for Dept in File2.
How can do this in Splunk?
I got to the point of concatenating the fields in file 1, but not sure how to do lookup based in concatenated value from file 2.
I have indexed both files in splunk.
Can anyone tell me if this is possible.
Thanks for your help,
Muru
basically I want to lookup a field from file2 by matching concatenation of fields "filer_name" and "vol_name" in file1 to concenation of same fields in file 2.
I don't understand the question.
However you can concatenate fields with eval
... |eval newfield=field1 . field2
Typically if you want to use file2 as a table to enrich file1, it's more convenient to set up the data as a lookup. You could generate a lookup from file2 by doing some gymnastics like:
source=file2 | fields Filer_Name, Dept, Volume_Name |outputlookup my_lookup
you might have to set up some conf to comprehend your lookup for meaningful use.
More about lookups: http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources
Once you have the lookup set up to work automatically or by invocation, it would become something like
source=file1 |lookup my_lookup | ...
where you may wish to filter the items to augment before or after the lookup.
Thanks, I was able to use lookup to accomplish what I wanted to do.
Thanks for your help,
-Muru
Many things are possible. Please show in more detail how you want the results presented. It's not really clear.