Splunk Search

Evaluate search with lookup field?

gljiva
Path Finder

Hi, I'm having problem with evaluating expression using lookup field. I create a lookup fileld by executing this search:
some search| stats avg(count) as Average | outputlookup Average.csv

Next i would like to use this value in other searches to evaluate some field with saved lookup value. I tried using lookup command but i can not append single field to all results, i can append field to separate entry but then i cant do: eval field1 > field2.

Any suggestions?
thx

0 Karma
1 Solution

Paolo_Prigione
Builder

What about using a fake lookup-field? Something like:

some search | stats avg(count) as Average | eval keyfield=12345 | outputlookup Average.csv

which will save two columns in the csv file: "keyfield" and "Average". Then, when you run the actual search you could do:

query search | eval keyfield=12345 | lookup Average.csv keyfield OUTPUT Average | where somefield > Average

in order to retrieve the stored value and filter results based on the stored Average.

View solution in original post

Paolo_Prigione
Builder

What about using a fake lookup-field? Something like:

some search | stats avg(count) as Average | eval keyfield=12345 | outputlookup Average.csv

which will save two columns in the csv file: "keyfield" and "Average". Then, when you run the actual search you could do:

query search | eval keyfield=12345 | lookup Average.csv keyfield OUTPUT Average | where somefield > Average

in order to retrieve the stored value and filter results based on the stored Average.

gljiva
Path Finder

Thanks, this works!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...