Solved: How to add columns from lookup table file to main ...

mzn1979 · ‎09-19-2020

Hi everyone

I do a search in Splunk and this is the results

I have a lookuptable file named apple.csv which is comprised of these contents.

So I want to add the Max_Price and Min_Price to the main search something like this

and then I can determine the wrong result. I mean the following result is not acceptable to me and they're may be wrong or something else.

apple	20	9/18/2020
apple	22674	9/19/2020

Thanks in advance

gcusello · ‎09-19-2020

you have to run something like this:

your_search
| lookup apple.csv Name Date OUTPUT Max_Price Min_Price
| Table Name Price Date Max_Price Min_Price

so you can list all the items adding the two columns from the lookup.

Then, if you want to check the Price with Max and Min, you have to add an eval statement:

| eval check=if(Price>Min_price AND Price<MaxPrice, "OK","NOK")

so you can filter the results:

| where check="NOK"

to have only the ones with Price outside the Min-Max range.

Ciao.

Giuseppe

gcusello · ‎09-19-2020

you have to run something like this:

your_search
| lookup apple.csv Name Date OUTPUT Max_Price Min_Price
| Table Name Price Date Max_Price Min_Price

so you can list all the items adding the two columns from the lookup.

Then, if you want to check the Price with Max and Min, you have to add an eval statement:

| eval check=if(Price>Min_price AND Price<MaxPrice, "OK","NOK")

so you can filter the results:

| where check="NOK"

to have only the ones with Price outside the Min-Max range.

Ciao.

Giuseppe

mzn1979 · ‎09-19-2020

Thank you. That worked perfectly

gcusello · ‎09-19-2020

good.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

How to add columns from lookup table file to main search