Splunk Search

How do I combine data from CSV with data from index

Path Finder

Now ,I have a lookup named exchange.csv , and index="exchange_data"
The data in the exchange.csv is extracted from index="exchange_data"It contains the fields extracted from the index data :

Sys_Name         App_Name
sys1              app1
sys2              app2

such as :
alt text
there are fields in the index="exchange_data" : ID,priority;
I want to get a table contains : ID ,priority, sysname ,appname
such as :
alt text
How can I combine them?

0 Karma

Splunk Employee
Splunk Employee

Hi @wxy,

Did either of the answers below solve your problem? If so, please resolve this post by approving one of them!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

SplunkTrust
SplunkTrust

If 0 fields in the csv match 0 fields in your data. Then you’ll not be able to use the lookup in a traditional manner.

Instead you could do this

| inputlookup yourloolup.csv
| append [ search index=exchange_data]

0 Karma

SplunkTrust
SplunkTrust

Try this

index=exchangedata | lookup exchange.csv SysName as host OUTPUT AppName | table _time ID, Priority SysName, App_Name

You have to have a field in your data that matches a field in your lookup.
They must match the field name and the value with cAsE sensitivity.

If SysName matches the host field in your exchangedata index then my search above would work fine. If you don’t have any fields in your data that match your lookup, you can’t really use the lookup.

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Lookup

0 Karma

Path Finder

And the fields in the exchange.csv are custom and do not exist in the data. The field value is in the data

0 Karma

Path Finder

but I can only use this command :|inputcsv
Other commands cannot query my csv file

0 Karma

Ultra Champion

Interesting command this inputcsv command -

inputcsv

It says -

For Splunk Enterprise deployments, loads search results from the specified .csv file, which is not modified. The filename must refer to a relative path in $SPLUNKHOME/var/run/splunk/csv (or $SPLUNKHOME/var/run/splunk/dispatch// if dispatch = true). If the specified file does not exist and the filename does not have an extension, then the Splunk software assumes it has a filename with a .csv extension.

0 Karma

Path Finder

I know this .But I can not use it to associate exchange.csv with index = exchange_data

0 Karma