Splunk Search

How to use a variable to determine which CSV lookup to use in my search?

moaf13
Path Finder

I have multiple CSV lookup files and I want to use a variable to determine which lookup table to choose in my search.

for example:

field1 {lookupFile, lookupFile2, lookupfile3,.....}
field2 {choose2, choose3, choose1, .....}

index="sample_index"  |mvexpand field2| eval  file_name= field2 + ".csv" | lookup file_name Id Ouput value | table *
0 Karma
1 Solution

woodcock
Esteemed Legend

I am sure that I understand your question but I completely do NOT understand your details so I will be starting over. Let's say you have 3 CSVs and if fieldX has value value1 you need to use lookupA, but for value2 you need to use lookupB and for value3 you need to use lookupC. You can do it like this:

... | eval keyA=if(fieldX="value1"), fieldX, null()) | lookup lookupA keyA
    | eval keyB=if(fieldX="value2"), fieldX, null()) | lookup lookupB keyB
    | eval keyC=if(fieldX="value3"), fieldX, null()) | lookup lookupC keyC

So even though you are doing all 3 lookups for every field, only 1 of the keys will exist for any given event which means that 2 lookups will always be skipped because the input field value does not exist (is null()).

View solution in original post

woodcock
Esteemed Legend

I am sure that I understand your question but I completely do NOT understand your details so I will be starting over. Let's say you have 3 CSVs and if fieldX has value value1 you need to use lookupA, but for value2 you need to use lookupB and for value3 you need to use lookupC. You can do it like this:

... | eval keyA=if(fieldX="value1"), fieldX, null()) | lookup lookupA keyA
    | eval keyB=if(fieldX="value2"), fieldX, null()) | lookup lookupB keyB
    | eval keyC=if(fieldX="value3"), fieldX, null()) | lookup lookupC keyC

So even though you are doing all 3 lookups for every field, only 1 of the keys will exist for any given event which means that 2 lookups will always be skipped because the input field value does not exist (is null()).

moaf13
Path Finder

thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...