All Apps and Add-ons

How to use dbx to lookup Ids?

plynch52
Explorer

I have a variable portion of a log file that is structured, all IDs are numeric. There are over 100K possible different IDs. It is not a fixed set of IDs, so coding individual field names doesn't work.
[id-1=cnt-1, id-2=cnt2, id-3=cnt3, ...,id-n=cnt-n]

this is parsed as
| rex field=stats max_match=100 "(?\d*=\d*)"

I want to replace the numeric id-n with a name from a table. I have the dbx lookup defined that provides
id-n, name.

Thanks from a newbie

Tags (1)
0 Karma

plynch52
Explorer

Thanks,
I goofed on copy the parse
rex field=stats max_match=100 "(? kvpair \d*=\d*)"
with angle brackets around kvpair

0 Karma

woodcock
Esteemed Legend

I usually start a search with |dbxquery and end it with | outputlookup MyLookup and schedule this to run every evening. Then I just use |lookup MyLookup in searches.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...