Hi everyone,
I use dbxquery and get this result from database:
id | count |
123 | 12 |
456 | 24 |
478 | 6 |
Also I have a csv file already put in lookup of Splunk like this:
id | type |
123 | Machine |
478 | Machine |
456 | Food |
987 | Food |
789 | Toys |
Please, how can I insert the column "type" from lookup to the search result above?
Basically this is what I want to achieve:
id | count | type |
123 | 12 | Machine |
478 | 6 | Machine |
456 | 24 | Food |
987 | 0 | Food |
789 | 0 | Toys |
I tried: |lookup lookupfile.csv id OUTPUT id type but it doesn't work
Thanks,
Julia
Hi @yuanliu @richgalloway ,
Sorry for not making it clear for the "it doesn't work". I meant nothing change in the result search.
Anw, by the end I found the reason, cause I forgot that Splunk cares the case sensitive. In the csv, I put "ID", but in splunk it's "id"
Have a nice day!
Hi @yuanliu @richgalloway ,
Sorry for not making it clear for the "it doesn't work". I meant nothing change in the result search.
Anw, by the end I found the reason, cause I forgot that Splunk cares the case sensitive. In the csv, I put "ID", but in splunk it's "id"
Have a nice day!
Your lookup command should have worked, but try this one.
| lookup lookupfile.csv id OUTPUT type
If that doesn't produce the desired results then please show or explain the results you do get. "it doesn't work" isn't very helpful.
I agree that "doesn't work" is not informative and should be avoided in any description.
Additionally, when you "put in lookup of Splunk," did you make a lookup definition? (In addition to upload the CSV file.) Did you name that definition as "lookupfile.csv" or something else? (I usually name my lookups "lookupfile" instead of "lookupfile.csv".)