Splunk Search

Cumulative time based (temporal) lookups possible?

I have some data in Splunk that I would like to link to some external CSV files

Splunk events have this format

_time, data, link1

The first CSV will be a time based lookup based on link1

dd/mm/yyyy, link1, link2, link3, data2, data3

The second CSV file will be another time based lookup but using data from first CSV to link (link2, link3)

dd/mm/yyyy, link2, link3, data4, data5

So I have have successfully linked the first CSV via this method
http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_...

What I want to know is if these lookups are cumulative?

ie will the second temporal lookup allow the use of results linked from the first lookup?

Or should I just go down the external script lookup route?

Tags (1)
1 Solution

Just posting the solution here in case someone else wants to know how it is done

transforms.conf

[customerLookup]
filename=customer-details.csv
time_field=contract_start
time_format = %d/%m/%Y

[chargesLookup]
filename=charges.csv
time_field=date
time_format = %d/%m/%Y

props.conf

[usage-data]
LOOKUP-customerCSV = customerLookup link1 OUTPUT link2 link3 data2 data3
LOOKUP-injectionChargesCSV = chargesLookup link2 link3 OUTPUT data4 data5

It works perfectly so its good to know this is possible.

View solution in original post

Just posting the solution here in case someone else wants to know how it is done

transforms.conf

[customerLookup]
filename=customer-details.csv
time_field=contract_start
time_format = %d/%m/%Y

[chargesLookup]
filename=charges.csv
time_field=date
time_format = %d/%m/%Y

props.conf

[usage-data]
LOOKUP-customerCSV = customerLookup link1 OUTPUT link2 link3 data2 data3
LOOKUP-injectionChargesCSV = chargesLookup link2 link3 OUTPUT data4 data5

It works perfectly so its good to know this is possible.

View solution in original post

Splunk Employee
Splunk Employee

Yes, they will run in sequence. The order is determined by the lexicographic order, so that LOOKUP-a will run before LOOKUP-b.

Ah good to know about the sequence they are run. Thanks

0 Karma

Scratch that is was an issue with my props.conf

IT WORKS!

0 Karma

I just did a test and it doesnt appear to work. But any suggestion on how to achieve this would be great.

0 Karma