Splunk Search

How to make a sequential lookup?

Arcite
Explorer

I have created a CSV from Linux's usb.ids (http://www.linux-usb.org/usb.ids ) that has vendor_id,product_id,VendorDesc,ProductDesc as the first line. I am trying to create a lookup that takes the Vendor Id and Product Id to fill in the Descriptions. When I do the search

... | lookup usb_ids.csv vendor_id AS vendor_id product_id AS product_id OUTPUT VendorDesc, ProductDesc

it works for any value that is unique. For example, vendor_id=04e6 and product_id=5116 does not work; I'm assuming that this happens because vendor_id=0486 appears in both the vendor_id and product_id fields and 5116 matches a few product_ids for different Vendors. Is there a way for it to match BOTH the vendor_id and product_id to get the correct values?

0 Karma
1 Solution

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

View solution in original post

0 Karma

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...