Splunk Search

How do I convert a country name to country code (or vice versa)?

nick405060
Motivator

How do I convert a CC to a country name in Splunk, or vice versa?

Since Splunk Answers won't let me post this question without it being longer (#logic), I need to do:

| makeresults | eval cc="US" | eval country="United States" | <test if they are equal>
1 Solution

niketnilay
Legend

@nick405060, I think you have implemented an incorrect approach for lookup file. You have indexed the lookup file instead of adding the same as Lookup file and creating Lookup Definition.

Refer to Splunk Documentation for Defining Lookup in Splunk. Once you have configured the same you can use lookup and inputlookup command to perform Country to Country Code and vice versa correlation depending on what is the field present in your data.

While the documentation links posted above have examples for each command. You can also search Splunk Answers for similar use cases. Following are couple of previous answers on similar lines:

https://answers.splunk.com/answers/132299/extracting-country-codes-from-phone-numbers.html
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@nick405060, I think you have implemented an incorrect approach for lookup file. You have indexed the lookup file instead of adding the same as Lookup file and creating Lookup Definition.

Refer to Splunk Documentation for Defining Lookup in Splunk. Once you have configured the same you can use lookup and inputlookup command to perform Country to Country Code and vice versa correlation depending on what is the field present in your data.

While the documentation links posted above have examples for each command. You can also search Splunk Answers for similar use cases. Following are couple of previous answers on similar lines:

https://answers.splunk.com/answers/132299/extracting-country-codes-from-phone-numbers.html
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

nick405060
Motivator

Thanks! You're right, I could have used a lookup instead of indexing and joining.

pruthvikrishnap
Contributor

you can use the replace command to do this.

https://answers.splunk.com/answers/568552/how-to-use-replace-in-search.html
Let me know if this helps.

0 Karma

nick405060
Motivator

That wouldn't work because CCs aren't uniform. FR is the first two characters of the country name, while US is the first and eighth character of the country name, CN is the first and fourth letter of the country name.

pruthvikrishnap
Contributor

if you have a list of CC's try adding them to a lookup file which would be much easier.

0 Karma

nick405060
Motivator

Yeah, that's what I ended up doing. Not super elegant but whatever. A moderator can convert your comment to an answer if they want. I just created country_codes.csv and then left joined my data with it.

<data> | join type=left Country [| search source="country_codes.csv" | table CC Country]
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!