Splunk Search

Append a lookup value from csv to a chart table

Topher22
Observer

I am looking to append a value in a lookup csv to an existing search

index=*
|fields _time,x |chart count(_raw) by X

and I want to replace(or append) the X with a value(name) from a csv so I can table the results.

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

If you have lots of events, performing lookup after stats will be more efficient.

index=*
| chart count by X
| lookup my-lookup.csv Y AS X OUTPUT X_description

This will add an extra field.  If you don't want to see X, just remove it with fields command.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Topher22 ,

you can append or replace a value , as you would, simply using the lookup command:

if in the lookup the field to replace is Y and must be related to X from the main search and you want to use the value X_descrition from the lookup, you can use something like this:

index=*
| lookup my-lookup.csv Y AS X OUTPUT X_description
| chart count(_raw) by X_description

 You can find more infos about the lookup command at https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...