Splunk Enterprise

Searching specific related fields from multiple CSV files.

jamieflowers198
New Member

I have 3 CSV files. The 1st holds one item/column of data I need. The 2nd holds several items related to the 1st and I only need that column related to file #1. The 3rd goes deeper and needs to be related to each item in file #2. 

IE: 

Data1     

                 Data2

                                    Data3

                                    Data3

                 Data2

                                    Data3

                                    Data3

                                    Data3

 

Anyone have any ideas? If I can't find a way to do this with a search I'll be stuck with a lot of copy/paste manual work.                  

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not much to work with, but perhaps this will get you started.

| inputlookup CSV1.csv
| lookup CSV2.csv someCSV2field as CSV1field OUTPUT moreCSV2fields
| lookup CSV3.csv someCSV3field as CSV2field OUTPUT more CSV3fields
| table CSV1field CSV2field CSV3fields
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...