Splunk Search

How can I search vlookup data from CSV?

naujla85
Explorer

Hello I have injested CSV data in lookup. The common data is Service_Method in CSV and dt.entity.service_method in Splunk Query. 

index="*dyn*" source="*:*dgf*" dt.entity.service_method=* metricId=builtin:service.keyRequest.count.total | stats avg(value) as "AvgValueCountTotal" count as "Total" by dt.entity.service_method

I am trying to combine this 2 data set in one table. 

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the lookup command to pull data from the CSV by common fields.

ndex="*dyn*" source="*:*dgf*" dt.entity.service_method=* metricId=builtin:service.keyRequest.count.total | stats avg(value) as "AvgValueCountTotal" count as "Total" by dt.entity.service_method
| lookup my lookup.csv Service_Method as dt.entity.service_method

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...