Splunk Search

How can I search vlookup data from CSV?

naujla85
Explorer

Hello I have injested CSV data in lookup. The common data is Service_Method in CSV and dt.entity.service_method in Splunk Query. 

index="*dyn*" source="*:*dgf*" dt.entity.service_method=* metricId=builtin:service.keyRequest.count.total | stats avg(value) as "AvgValueCountTotal" count as "Total" by dt.entity.service_method

I am trying to combine this 2 data set in one table. 

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the lookup command to pull data from the CSV by common fields.

ndex="*dyn*" source="*:*dgf*" dt.entity.service_method=* metricId=builtin:service.keyRequest.count.total | stats avg(value) as "AvgValueCountTotal" count as "Total" by dt.entity.service_method
| lookup my lookup.csv Service_Method as dt.entity.service_method

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...