Hi,
looking for splunk query having field name similar to field in lookup file with respective value in lookup file.
query have field "index" value is same as lookup file field "CAPNSplunk" value.
if "index" field value matches with lookup file "CAPNSplunk" then "index" field value should get replaced with associated "RANSplunk" field value available in lookup file.
lookup file:
CAPNSplunk,RANSplunk
"Pricing","Pricing Outlier"
"Smart_Factory","Smart Factory BUCT"
"SMARTFACTORY_LOGISTICS","Smart Factory Logistics"
"SmartFactory_PM_Console","Smart Factory PM Console"
"GCW_Dashboard","Global Contingent Worker Dashboard"
"HRM_Spans_Layers","HRM - Spans & Layers"
"Unity_Portal-Part_Aggregation","Unity Portal"
"Blackbird_Dashboard","Blackbird"
"WWops","WWOps"
"AGS_metrology_AutoML","Metrology Auto ML Classification"
"Action_Plan_Tracker","IDCL"
index:
Pricing |
Smart_Factory |
SMARTFACTORY_LOGISTICS |
SmartFactory_PM_Console |
GCW_Dashboard |
HRM_Spans_Layers |
Unity_Portal-Part_Aggregation |
Blackbird_Dashboard |
WWops |
AGS_metrology_AutoML |
Action_Plan_Tracker |
For example:
if "index" field value is "Pricing" then it should get replaced with "Pricing Outlier" after looking into lookup file.
You could try this
| lookup lookupfile CAPNSplunk AS index OUTPUT index AS RANSplunk
Although, using field names such as index might cause issues as this is a system supplied field.
https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Lookup
renamed eval field "index" with "app" .
Getting below mentioned screenshot error.
Kindly suggest.
Sorry, I had the output fields the wrong way around, try it this way
| lookup AppName.csv CAPNSplunk AS app OUTPUT RANSplunk AS app
Thanks for response, that's not my requirement.
this lookup query gives only app available in lookup file with replaced name.
app which is not available in lookup file should be as it is.
for example "ADKB" app is not available in lookup file it should come in output as it is.
lookup query should replace app name which is available in lookup file rest app name should be as it is.
Try this
| lookup AppName.csv CAPNSplunk AS app
| eval app=coalesce(RANSplunk,app)