Getting Data In

CSV with Lookup

phanikumarcs
Explorer

Hi @ITWhisperer 
@gcusello @ITWhisperer  please help

This is the other issue which is related to csv dataset and lookup dataset.

From this SPL: source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv"

Getting output below

Subscription Resource Key Vault Secret Expiration Date Months
BoB-foo Dicore-automat Dicore-automat-keycoreDi core-tuubsp1sct 2022-07-28-21
BoB-foo Dicore-automat Dicore-automat-keycore Dicore-stor1scrt 2022-07-28-21
BoB-foo G01462-mgmt-foo G86413-vaultcore G86413-secret-foo

 

From this lookup: | inputlookup cmklookup.csv
Getting output below

ApplicationenvironmentappOwner
CaliberDicore - TCGfoo@gmail.com
KeygroupG01462 - QAgoo@gmail.com
KeygroupG01462 - SITboo@gmail.com

 

Combine the two queries into one, where the output will only display results where the 'environment' and 'Resource' fields match. For instance, if 'G01462' matches in both fields across both datasets, it should be included in the output. How i can do this, could anyone help here to write spl. I wrote some of the Spls but it's not working for me.

source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv"
|join type=inner [ | inputlookup cmklookup.csv environment]

source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv"
| lookup cmklookup.csv environment AS "Resource" OUTPUT "environment"

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your example, G01462 doesn't (completely) match any entry in either Resource or environment. Lookup requires an exact match (unless you define it as a wildcard lookup or CIDR). In the case of G01462-mgmt-foo, would you want the lookup to find either G01462 - QA or  G01462 - SIT or both?

0 Karma

phanikumarcs
Explorer

Indeed, the objective is to utilize a lookup operation to match 'G01462' and find either 'G01462 - QA' or 'G01462 - SIT', or both.

Alternatively, can I modify the lookup operation to precisely match the "newResource" field with the "Resource" field to retrieve the corresponding values of the "environment" field in the

ApplicationenvironmentappOwnernewResource
CaliberDicore - TCGfoo@gmail.comDicore-automat
KeygroupG01462 - QAgoo@gmail.comDicore-automat
KeygroupG01462 - SITboo@gmail.comG01462-mgmt-foo


0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do that then!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...