Splunk Enterprise

Searching specific related fields from multiple CSV files.

jamieflowers198
New Member

I have 3 CSV files. The 1st holds one item/column of data I need. The 2nd holds several items related to the 1st and I only need that column related to file #1. The 3rd goes deeper and needs to be related to each item in file #2. 

IE: 

Data1     

                 Data2

                                    Data3

                                    Data3

                 Data2

                                    Data3

                                    Data3

                                    Data3

 

Anyone have any ideas? If I can't find a way to do this with a search I'll be stuck with a lot of copy/paste manual work.                  

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not much to work with, but perhaps this will get you started.

| inputlookup CSV1.csv
| lookup CSV2.csv someCSV2field as CSV1field OUTPUT moreCSV2fields
| lookup CSV3.csv someCSV3field as CSV2field OUTPUT more CSV3fields
| table CSV1field CSV2field CSV3fields
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...