Splunk Search

Hi i want to join a field from log file and lookup table

ujwalagangakoth
New Member

for eg in a.log file i have data as

dept_id Name Leave_count
1 xx 9
2 yy 8
3 zz 4
and have a b.csv lookup table file which has

dept_id designation allowed_leave
1 manager 10
2 TL 6
3 senior manager 10

now i want to compare leave count and allowed leave by joining a.log and b.csv lookup table using dept_id and display name,designation which satisfies (allowed_leave-leave count)< 0

Tags (2)
0 Karma

niketn
Legend

If you have Lookup Definition created as b from (Settings > Lookups > Lookup Definition) for lookup table b.csv, you can use the following:

<YourBaseSearchWithIndexAndHostName> source="a.log"
| lookup b dept_id OUTPUT allowed_leave designation
| where allowed_leave<Leave_count
| table Name dept_id allowed_leave Leave_count designation

Refer to lookup command documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@ujwalagangakotha were you able to try out the answer?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...