I have some data in Splunk that I would like to link to some external CSV files
Splunk events have this format
_time, data, link1
The first CSV will be a time based lookup based on link1
dd/mm/yyyy, link1, link2, link3, data2, data3
The second CSV file will be another time based lookup but using data from first CSV to link (link2, link3)
dd/mm/yyyy, link2, link3, data4, data5
So I have have successfully linked the first CSV via this method
What I want to know is if these lookups are cumulative?
ie will the second temporal lookup allow the use of results linked from the first lookup?
Or should I just go down the external script lookup route?
I just did a test and it doesnt appear to work. But any suggestion on how to achieve this would be great.
Yes, they will run in sequence. The order is determined by the lexicographic order, so that LOOKUP-a will run before LOOKUP-b.
Just posting the solution here in case someone else wants to know how it is done
[customerLookup] filename=customer-details.csv time_field=contract_start time_format = %d/%m/%Y [chargesLookup] filename=charges.csv time_field=date time_format = %d/%m/%Y
[usage-data] LOOKUP-customerCSV = customerLookup link1 OUTPUT link2 link3 data2 data3 LOOKUP-injectionChargesCSV = chargesLookup link2 link3 OUTPUT data4 data5
It works perfectly so its good to know this is possible.