Splunk Search

How to make a sequential lookup?

Arcite
Explorer

I have created a CSV from Linux's usb.ids (http://www.linux-usb.org/usb.ids ) that has vendor_id,product_id,VendorDesc,ProductDesc as the first line. I am trying to create a lookup that takes the Vendor Id and Product Id to fill in the Descriptions. When I do the search

... | lookup usb_ids.csv vendor_id AS vendor_id product_id AS product_id OUTPUT VendorDesc, ProductDesc

it works for any value that is unique. For example, vendor_id=04e6 and product_id=5116 does not work; I'm assuming that this happens because vendor_id=0486 appears in both the vendor_id and product_id fields and 5116 matches a few product_ids for different Vendors. Is there a way for it to match BOTH the vendor_id and product_id to get the correct values?

0 Karma
1 Solution

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

View solution in original post

0 Karma

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Join the Final Session of the Data Management & Federation Bootcamp Series

Over the past three sessions of the Data Management & Federation Bootcamp Series, we've explored how to build ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...