Splunk Search

Create fields from the lookup content

corti77
Communicator

Hi,

In order to parametrize the search, I created a lookup with a couple of numerical values that I would like to easily change when necessary.

the format of the csv file (test.csv) is the following (this format could be changed based on the answers to this post)

Threshold          Value

name1                 value1

name2                 value2

the only way to do what I want is the following query

| eval tempField="name1"
| lookup test.csv Threshold as tempField OUTPUT Value as test1value

 

any better or more efficient way of doing this?

I was imagining something like the line below but it didnt manage to make it work.

| lookup test.csv Threshold  as "name1" OUTPUT Value as test1value

thanks!

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you looking to have both values available at the same time? If so, you might consider changing your lookup to 

testvalue1testvalue2
value1value2

then use inputlookup to add them to your search

0 Karma

corti77
Communicator

I created the CSV the way you proposed as I need to have both fields at the same time and I tried the following

index=_internal
| head 5
| inputlookup append=t test.csv

but it only creates new columns in a new event

corti77_0-1631019603698.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=_internal
| head 5
| inputlookup append=t test.csv
| eventstats values(CriticalDefault) as CriticalDefault values(WarningDefault) as WarningDefault
| where isnotnull(_raw)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...