Splunk Search

CSV Lookup not matching double quotes

keerthana_k
Communicator

I have created a csv file mapping a field from my raw index to a more readable version. Some of the values for that field in my log has double quotes. I have also included quotes in my csv file for those values. However, the values with double quotes are not getting matched. For the other values, the lookup is working fine. Any ideas how to overcome this and include double quotes in the lookup? Thanks in advance.

Tags (1)
1 Solution

mthierbel
Explorer

I was able to get this working by using three double-quotes.

If my field looks like this:

"foo"

Then my .csv lookup matches it if I set it as

"""foo"""

So, overall, my lookup table would look like this (with the top line being the header):

field1,field2
"""foo""",bar

View solution in original post

romantic_warrio
New Member

Thanks for responding.

I looked at the CSV and the "appId" field is not quoted; in the database (using DB Connect Input Service) the "RELATED_AIT_NUMBER" the field is defined as an int.

I have a workaround for now by modifying my query to join on the app table in the database and aliasing the field so my searches don't break. I'm thinking that there must be a way to tell how Splunk sees the fields. When I figure this out, I will post the solution here.

0 Karma

mthierbel
Explorer

I was able to get this working by using three double-quotes.

If my field looks like this:

"foo"

Then my .csv lookup matches it if I set it as

"""foo"""

So, overall, my lookup table would look like this (with the top line being the header):

field1,field2
"""foo""",bar
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...