Splunk Enterprise

Searching specific related fields from multiple CSV files.

jamieflowers198
New Member

I have 3 CSV files. The 1st holds one item/column of data I need. The 2nd holds several items related to the 1st and I only need that column related to file #1. The 3rd goes deeper and needs to be related to each item in file #2. 

IE: 

Data1     

                 Data2

                                    Data3

                                    Data3

                 Data2

                                    Data3

                                    Data3

                                    Data3

 

Anyone have any ideas? If I can't find a way to do this with a search I'll be stuck with a lot of copy/paste manual work.                  

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not much to work with, but perhaps this will get you started.

| inputlookup CSV1.csv
| lookup CSV2.csv someCSV2field as CSV1field OUTPUT moreCSV2fields
| lookup CSV3.csv someCSV3field as CSV2field OUTPUT more CSV3fields
| table CSV1field CSV2field CSV3fields
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...