How to use a lookup file to create a new field? (Ex: Http Status code and description from csv file -> create new field http_description)

[Kukkadapu]

Hi ,
How do I create a new field based on the lookup file (csv file has tow columns - status , description). Now I wanted to match the status with the http_status field and create a new field http_status_desc, Or display the http_status with the description from the file.

Can you give me the steps to create?

Thanks,
Mani

[javiergn · Accepted solution]

You can use the eval command to create a new field based on the result of your lookup table.
If you post the query you are running we might be able to help a bit more.

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Eval

[Kukkadapu]

Thanks Javiergn. That worked 🙂

[Kukkadapu]

Hey Javiergn, I've not yet used any query. I got to know that, I should use Automatic lookups , so a new field with the description is automatically created when the data comes in. But not sure how to do that.

[javiergn]

Hi,

Take a look at this:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usefieldlookupstoaddinformationtoyoureve...

There's even an example about http status lookups at the bottom.

Hope that helps.