Splunk Search

How to make a sequential lookup?

Arcite
Explorer

I have created a CSV from Linux's usb.ids (http://www.linux-usb.org/usb.ids ) that has vendor_id,product_id,VendorDesc,ProductDesc as the first line. I am trying to create a lookup that takes the Vendor Id and Product Id to fill in the Descriptions. When I do the search

... | lookup usb_ids.csv vendor_id AS vendor_id product_id AS product_id OUTPUT VendorDesc, ProductDesc

it works for any value that is unique. For example, vendor_id=04e6 and product_id=5116 does not work; I'm assuming that this happens because vendor_id=0486 appears in both the vendor_id and product_id fields and 5116 matches a few product_ids for different Vendors. Is there a way for it to match BOTH the vendor_id and product_id to get the correct values?

0 Karma
1 Solution

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

View solution in original post

0 Karma

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...