Splunk Search

Hi i want to join a field from log file and lookup table

New Member

for eg in a.log file i have data as

dept_id Name Leave_count
1 xx 9
2 yy 8
3 zz 4
and have a b.csv lookup table file which has

dept_id designation allowed_leave
1 manager 10
2 TL 6
3 senior manager 10

now i want to compare leave count and allowed leave by joining a.log and b.csv lookup table using dept_id and display name,designation which satisfies (allowed_leave-leave count)< 0

Tags (2)
0 Karma


If you have Lookup Definition created as b from (Settings > Lookups > Lookup Definition) for lookup table b.csv, you can use the following:

<YourBaseSearchWithIndexAndHostName> source="a.log"
| lookup b dept_id OUTPUT allowed_leave designation
| where allowed_leave<Leave_count
| table Name dept_id allowed_leave Leave_count designation

Refer to lookup command documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


@ujwalagangakotha were you able to try out the answer?

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...