Getting Data In

An external script saves "host" values in a csv, but names the field after the first result. How do I get the file to name the field "host" to run an inputlookup?

tkwaller
Builder

Hello

I have an external script that runs and saves the results in a file I called puppet_results.csv in $SPLUNK_HOME/etc/apps/search/lookups. I verified that it returns results by running | inputlookup puppet_results.csv which returned 482 results so the data is there.

So I created a search:

index=_internal | dedup host | inputlookup append=t puppet_results.csv | stats count by host | where count < 2 

I get the results of the initial search, but get no results from the "inputlookup" portion.

The reason is that the field host in the puppet_results.csv from the script is not named "host". It's named after the first result in the file.

Any idea on how I could get the file to name the field as "host"?

Thanks for the help!

0 Karma

aalanisr26
Path Finder

The easiest way would be to change the external script to include the header, but if this is not an option we need to fix the lookup to force "host" header, this is what I would do:

|inputlookup puppet_results.csv | transpose|transpose|eval host='row 1'| fields - "row 1",column | outputlookup puppet_resultswithheader.csv

that would fix the column name as host and use the first value you had before as a value not as a header.

then you can run your query:

 index=_internal | dedup host | inputlookup append=t puppet_resultswithheader.csv | stats count by host | where count < 2
0 Karma

aweitzman
Motivator

The easiest thing to do here would probably be to change your external script so that the first line of your CSV contains the field names of the columns.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...