Reporting

table question to add addtional columns/fields

omun0z
Explorer

Hello, I'm trying to add additional columns/fields from an additional CSV table lookup at the end of the table part in a search syntax to create a Report as below, but I'm not sure if that is possible as is not working, I just get a couple of blank additional columns with some error names.

sourcetype=ib:ipam:network index=ib_ipam | eval dedup_key=view."/".address."/".cidr | dedup dedup_key | eval Network_CIDR=address."/".cidr | search view = "Ashland" | ................................................................................................ | table Timestamp, "Network View", Network, CIDR, Total, Allocated, Reserved, Assigned, Protocol, "Utilization %", Unmanaged, [|inputlookup Ashland-Networks-EAs.csv |search Network = Network_CIDR |table Network, Region_DDI]

Any help would be very appreciated.

Thanks,

Omar.

Labels (1)
Tags (1)
0 Karma
1 Solution

omun0z
Explorer

Thank you so much!! It worked.

View solution in original post

0 Karma

omun0z
Explorer

Hi to4kawa, I tried to add [|inputlookup Ashland-Networks-EAs.csv |search Network = Network_CIDR |table Network, Region_DDI]  in the table part to add additional columns/fields based on the comun column Network_CIDR....  I think this is not the correct way, but not sure if this is possible.

 

Thanks,

 

Omar.

0 Karma

to4kawa
Ultra Champion
0 Karma

omun0z
Explorer

Thank you so much!! It worked.

0 Karma

to4kawa
Ultra Champion

sample:

|makeresults | table[| inputlookup geo_attr_countries.csv | table iso2 iso3]

This can't work.

your sub search can't work.  What do you want to do? 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...