Splunk Search

Help with lookup table

Abhineet
Loves-to-Learn Everything

Hi, 

looking for splunk query having field name similar to field in lookup file with respective value in lookup file.

query have field "index" value is same as lookup file field "CAPNSplunk" value.

if "index" field value matches with lookup file "CAPNSplunk" then "index" field value should get replaced with associated "RANSplunk" field value available in lookup file.

lookup file:

CAPNSplunk,RANSplunk
"Pricing","Pricing Outlier"

"Smart_Factory","Smart Factory BUCT"
"SMARTFACTORY_LOGISTICS","Smart Factory Logistics"
"SmartFactory_PM_Console","Smart Factory PM Console"
"GCW_Dashboard","Global Contingent Worker Dashboard"
"HRM_Spans_Layers","HRM - Spans & Layers"
"Unity_Portal-Part_Aggregation","Unity Portal"
"Blackbird_Dashboard","Blackbird"
"WWops","WWOps"
"AGS_metrology_AutoML","Metrology Auto ML Classification"
"Action_Plan_Tracker","IDCL"

 

index:

Pricing
Smart_Factory
SMARTFACTORY_LOGISTICS
SmartFactory_PM_Console
GCW_Dashboard
HRM_Spans_Layers
Unity_Portal-Part_Aggregation
Blackbird_Dashboard
WWops
AGS_metrology_AutoML

Action_Plan_Tracker

 

For example:

if "index" field value is "Pricing" then it should get replaced with "Pricing Outlier" after looking into lookup file.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try this

| lookup lookupfile CAPNSplunk AS index OUTPUT index AS RANSplunk

Although, using field names such as index might cause issues as this is a system supplied field.

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Lookup 

0 Karma

Abhineet
Loves-to-Learn Everything

renamed eval field "index" with "app" .

Getting below mentioned screenshot error.

Abhineet_0-1679593956452.png

 

Kindly suggest.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I had the output fields the wrong way around, try it this way

| lookup AppName.csv CAPNSplunk AS app OUTPUT RANSplunk AS app
0 Karma

Abhineet
Loves-to-Learn Everything

Thanks for response, that's not my requirement.

this lookup query gives only app available in lookup file with replaced name.

app which is not available in lookup file should be as it is.

for example "ADKB" app is not available in lookup file it should come in output as it is.

lookup query should replace app name which is available in lookup file rest app name should be as it is.

Abhineet_0-1679650516054.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| lookup AppName.csv CAPNSplunk AS app
| eval app=coalesce(RANSplunk,app)
0 Karma

Abhineet
Loves-to-Learn Everything

Thanks....

It's working as expected.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...