Splunk Search
Highlighted

How do you retrieve particular data from one field?

Explorer

Hi,

i have a CSV file that contains a few persons names and teamname(column names is "name" and "Team"). The team name is the same for all in the CSV file. Now, I want to display the name of the person who is raised from the CSV file.

Ex: CSV file contains

name Team
raju Testing
ramesh Testing
rakesh Testing

if my assigned_to have
Richard
Robart
ramesh
raju

i want to display the last person who is changed from the assigned_to. Here is i want "ramesh" should display.Please help how to do this?

index="one" sourcetype="generated"  Number=* status=*  group=* |dedup _time,Number,group |streamstats current=f last(group) as Group, last(visible) as  Visible last(assigned_to) as Assigned_to by Number|lookup test.csv name as assigned_to OUTPUT Team| eval raised= if(group!=Group AND group="Testing Team",1,NULL) | stats count(raised) AS "Raised Cases" by assigned_to,Team| fields - Team
0 Karma
Highlighted

Re: How do you retrieve particular data from one field?

Communicator

Hi

Why dont you filter the events with the CSV with the inputlookup command? In this way you only get the events where assigned_to contains only those people of your list.

index="one" sourcetype="generated"  Number=* status=*  group=* [ | inputlookup test.csv | field name | rename name as assigned_to ]

Would that help?

0 Karma