Splunk Search

How do you retrieve particular data from one field?

ramesh12345
Explorer

Hi,

i have a CSV file that contains a few persons names and teamname(column names is "name" and "Team"). The team name is the same for all in the CSV file. Now, I want to display the name of the person who is raised from the CSV file.

Ex: CSV file contains

name Team
raju Testing
ramesh Testing
rakesh Testing

if my assigned_to have
Richard
Robart
ramesh
raju

i want to display the last person who is changed from the assigned_to. Here is i want "ramesh" should display.Please help how to do this?

index="one" sourcetype="generated"  Number=* status=*  group=* |dedup _time,Number,group |streamstats current=f last(group) as Group, last(visible) as  Visible last(assigned_to) as Assigned_to by Number|lookup test.csv name as assigned_to OUTPUT Team| eval raised= if(group!=Group AND group="Testing Team",1,NULL) | stats count(raised) AS "Raised Cases" by assigned_to,Team| fields - Team
0 Karma

markusspitzli
Communicator

Hi

Why dont you filter the events with the CSV with the inputlookup command? In this way you only get the events where assigned_to contains only those people of your list.

index="one" sourcetype="generated"  Number=* status=*  group=* [ | inputlookup test.csv | field name | rename name as assigned_to ]

Would that help?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...