Reporting

table question to add addtional columns/fields

omun0z
Explorer

Hello, I'm trying to add additional columns/fields from an additional CSV table lookup at the end of the table part in a search syntax to create a Report as below, but I'm not sure if that is possible as is not working, I just get a couple of blank additional columns with some error names.

sourcetype=ib:ipam:network index=ib_ipam | eval dedup_key=view."/".address."/".cidr | dedup dedup_key | eval Network_CIDR=address."/".cidr | search view = "Ashland" | ................................................................................................ | table Timestamp, "Network View", Network, CIDR, Total, Allocated, Reserved, Assigned, Protocol, "Utilization %", Unmanaged, [|inputlookup Ashland-Networks-EAs.csv |search Network = Network_CIDR |table Network, Region_DDI]

Any help would be very appreciated.

Thanks,

Omar.

Labels (1)
Tags (1)
0 Karma
1 Solution

omun0z
Explorer

Thank you so much!! It worked.

View solution in original post

0 Karma

omun0z
Explorer

Hi to4kawa, I tried to add [|inputlookup Ashland-Networks-EAs.csv |search Network = Network_CIDR |table Network, Region_DDI]  in the table part to add additional columns/fields based on the comun column Network_CIDR....  I think this is not the correct way, but not sure if this is possible.

 

Thanks,

 

Omar.

0 Karma

to4kawa
SplunkTrust
SplunkTrust
0 Karma

omun0z
Explorer

Thank you so much!! It worked.

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust

sample:

|makeresults | table[| inputlookup geo_attr_countries.csv | table iso2 iso3]

This can't work.

your sub search can't work.  What do you want to do? 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.