Getting Data In

How to show customized data in output?

avd
New Member

Hi, I've recently started using Splunk logs. I have a query to fetch client IDs who call my APIs. These client IDs are some UUIDs. I would rather like to see a customized name for these IDs. 

For example, I can save the mapping of the client ID and its easy-to-read client name in a CSV or somewhere and want my Splunk query to show the client name.

Is this possible? Could someone help how to do it?

Labels (1)
0 Karma

jeffland
SplunkTrust
SplunkTrust

There is more than one way to do it. Since you mentioned csv already, let's use that. I'm going to assume it has two columns, uuid and client_id.

You need your csv in Splunk for this of course - so either upload it or create it in Splunk if you haven't done so already. Next, I'd suggest you create a lookup definition for your csv file. Then, you'd use your lookup like this:

index=this <your search finding UUIDs>
| lookup your_lookup_definition uuid OUTPUT client_id
| table _time client_id src_ip method (or whatever other fields you want)

If this is something you always want for this type of data, you might want to consider an automatic lookup. That would make splunk implicitly run that | lookup command for all searches against e.g. this sourcetype, so you wouldn't need to have it in every SPL explicitly.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...