Archive
Highlighted

Use automatic lookup to match one lookup field to multiple event fields

New Member

I have a set of event data that contains id numbers instead of names. I have a lookup table created to match those id numbers to names. The problem is I can't figure out how to match the one lookup field "id" to all of the different variations of "id" in the event data. The event data uses fields like "assigneeid", "emailccid", "requesterid", and ","collaborator_id".

0 Karma
Highlighted

Re: Use automatic lookup to match one lookup field to multiple event fields

SplunkTrust
SplunkTrust

@chioverheaddoors,

Try combining the fields,

eval id=coalesce(assignee_id,email_cc_id,requester_id,collaborator_id)
0 Karma
Highlighted

Re: Use automatic lookup to match one lookup field to multiple event fields

New Member

Thank you for your fast response. I dont think that will work as I need to list all of those fields individually

0 Karma
Highlighted

Re: Use automatic lookup to match one lookup field to multiple event fields

Contributor

How about joining on an evaluated field that uses an order of precedence to determine what the join will be on? You could keep all the original fields for your output, and just have the evaluated field for the purposes of joining. So something like:

[base search] | fillnull value="" | eval joiner=if(assignee_id!="",assignee_id,if(email_cc_id!="",email_cc_id,if(requester_id!="",requester_id,if(collaborator_id!="",collaborator_id,"")))) | lookup ID as joiner output ....
0 Karma
Highlighted

Re: Use automatic lookup to match one lookup field to multiple event fields

New Member

I actually just got it to work by nesting the lookup command and bypassing the automatic lookup I had created.

| lookup zenuserids.csv id as submitterid OUTPUTNEW name as submittername | lookup zenuserids.csv id as requesterid OUTPUTNEW name as requestername | lookup zenuserids.csv id as assignee_id OUTPUTNEW name as assigneename | table id,submittername,requestername,assigneename

0 Karma