Splunk Search

Help with lookup table

Abhineet
Loves-to-Learn Everything

Hi, 

looking for splunk query having field name similar to field in lookup file with respective value in lookup file.

query have field "index" value is same as lookup file field "CAPNSplunk" value.

if "index" field value matches with lookup file "CAPNSplunk" then "index" field value should get replaced with associated "RANSplunk" field value available in lookup file.

lookup file:

CAPNSplunk,RANSplunk
"Pricing","Pricing Outlier"

"Smart_Factory","Smart Factory BUCT"
"SMARTFACTORY_LOGISTICS","Smart Factory Logistics"
"SmartFactory_PM_Console","Smart Factory PM Console"
"GCW_Dashboard","Global Contingent Worker Dashboard"
"HRM_Spans_Layers","HRM - Spans & Layers"
"Unity_Portal-Part_Aggregation","Unity Portal"
"Blackbird_Dashboard","Blackbird"
"WWops","WWOps"
"AGS_metrology_AutoML","Metrology Auto ML Classification"
"Action_Plan_Tracker","IDCL"

 

index:

Pricing
Smart_Factory
SMARTFACTORY_LOGISTICS
SmartFactory_PM_Console
GCW_Dashboard
HRM_Spans_Layers
Unity_Portal-Part_Aggregation
Blackbird_Dashboard
WWops
AGS_metrology_AutoML

Action_Plan_Tracker

 

For example:

if "index" field value is "Pricing" then it should get replaced with "Pricing Outlier" after looking into lookup file.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try this

| lookup lookupfile CAPNSplunk AS index OUTPUT index AS RANSplunk

Although, using field names such as index might cause issues as this is a system supplied field.

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Lookup 

0 Karma

Abhineet
Loves-to-Learn Everything

renamed eval field "index" with "app" .

Getting below mentioned screenshot error.

Abhineet_0-1679593956452.png

 

Kindly suggest.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I had the output fields the wrong way around, try it this way

| lookup AppName.csv CAPNSplunk AS app OUTPUT RANSplunk AS app
0 Karma

Abhineet
Loves-to-Learn Everything

Thanks for response, that's not my requirement.

this lookup query gives only app available in lookup file with replaced name.

app which is not available in lookup file should be as it is.

for example "ADKB" app is not available in lookup file it should come in output as it is.

lookup query should replace app name which is available in lookup file rest app name should be as it is.

Abhineet_0-1679650516054.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| lookup AppName.csv CAPNSplunk AS app
| eval app=coalesce(RANSplunk,app)
0 Karma

Abhineet
Loves-to-Learn Everything

Thanks....

It's working as expected.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...