Help with lookup table

[Abhineet]

Hi, 

looking for splunk query having field name similar to field in lookup file with respective value in lookup file.

query have field "index" value is same as lookup file field "CAPNSplunk" value.

if "index" field value matches with lookup file "CAPNSplunk" then "index" field value should get replaced with associated "RANSplunk" field value available in lookup file.

lookup file:

CAPNSplunk,RANSplunk
"Pricing","Pricing Outlier"

"Smart_Factory","Smart Factory BUCT"
"SMARTFACTORY_LOGISTICS","Smart Factory Logistics"
"SmartFactory_PM_Console","Smart Factory PM Console"
"GCW_Dashboard","Global Contingent Worker Dashboard"
"HRM_Spans_Layers","HRM - Spans & Layers"
"Unity_Portal-Part_Aggregation","Unity Portal"
"Blackbird_Dashboard","Blackbird"
"WWops","WWOps"
"AGS_metrology_AutoML","Metrology Auto ML Classification"
"Action_Plan_Tracker","IDCL"

index:

Pricing

Smart_Factory

SMARTFACTORY_LOGISTICS

SmartFactory_PM_Console

GCW_Dashboard

HRM_Spans_Layers

Unity_Portal-Part_Aggregation

Blackbird_Dashboard

WWops

AGS_metrology_AutoML

Action_Plan_Tracker

For example:

if "index" field value is "Pricing" then it should get replaced with "Pricing Outlier" after looking into lookup file.

[ITWhisperer]

You could try this

| lookup lookupfile CAPNSplunk AS index OUTPUT index AS RANSplunk

Although, using field names such as index might cause issues as this is a system supplied field.

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Lookup 

[Abhineet]

renamed eval field "index" with "app" .

Getting below mentioned screenshot error.

Kindly suggest.

[ITWhisperer]

Sorry, I had the output fields the wrong way around, try it this way

| lookup AppName.csv CAPNSplunk AS app OUTPUT RANSplunk AS app

[Abhineet]

Thanks for response, that's not my requirement.

this lookup query gives only app available in lookup file with replaced name.

app which is not available in lookup file should be as it is.

for example "ADKB" app is not available in lookup file it should come in output as it is.

lookup query should replace app name which is available in lookup file rest app name should be as it is.

[ITWhisperer]

Try this

| lookup AppName.csv CAPNSplunk AS app
| eval app=coalesce(RANSplunk,app)

[Abhineet]

Thanks....

It's working as expected.