Splunk Search

Better search query way in terms of performance

N92
Path Finder

I have below search criteria so let me know best way for this.

base search (which have output in table format) [table sourcetype def ghi]
sourcetype= 1 check with static lookup and store respective result in "ghi" field
sourcetype= 2 check with static lookup and store respective result in "ghi" field

Tags (1)
0 Karma

tscroggins
Influencer

Create a simple lookup file, e.g. sourcetype_ghi_lookup.csv, with two fields, sourcetype and ghi. E.g. For sourcetype=1 and sourcetype=2:

sourcetype,ghi
1,"some ghi value"
2,"another ghi value"

| lookup sourcetype_ghi_lookup.csv sourcetype output ghi

You can use the file in both a lookup and automatic lookup definition to omit the lookup command in searches and populate the ghi field automatically.

0 Karma

somesoni2
Revered Legend

Give this a try

your base search
| lookup yourSourcetype1lookup.csv fieldName OUTPUT ghi as ghi1
| lookup yourSourcetype2lookup.csv fieldName OUTPUT ghi as ghi2
| eval ghi=iff(sourcetype="sourcetype1", ghi1,ghi2) | fields - ghi1 ghi2
0 Karma

N92
Path Finder

It works. Thanks @somesoni2

0 Karma

jpolvino
Builder

Can you please provide samples of what your table represents, and what you want to do with the two sourcetype lines you mention?

0 Karma

N92
Path Finder

| table dest user source sourcetype result
| lookup users.csv users as user OUTPUT host_name as result
| lookup users.csv source as user OUTPUT host_name as result

For both the lookup condition I am try to distinguish with sourcetype condition.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...