Splunk Search

How to make a sequential lookup?

Arcite
Explorer

I have created a CSV from Linux's usb.ids (http://www.linux-usb.org/usb.ids ) that has vendor_id,product_id,VendorDesc,ProductDesc as the first line. I am trying to create a lookup that takes the Vendor Id and Product Id to fill in the Descriptions. When I do the search

... | lookup usb_ids.csv vendor_id AS vendor_id product_id AS product_id OUTPUT VendorDesc, ProductDesc

it works for any value that is unique. For example, vendor_id=04e6 and product_id=5116 does not work; I'm assuming that this happens because vendor_id=0486 appears in both the vendor_id and product_id fields and 5116 matches a few product_ids for different Vendors. Is there a way for it to match BOTH the vendor_id and product_id to get the correct values?

0 Karma
1 Solution

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

View solution in original post

0 Karma

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...