Splunk Search

How to use inputlookup in a search, but convert the field of a stats by some column by the field of another column?

MPJ44
Loves-to-Learn Everything

I have a .csv with this format (this is a mock, just to give you an idea of the pattern)

code, message,

1, "Not found",

2, "Internal error",

3, "Success",

 

My search allow to do a stats count by code, but not by message.


What I need to do is return a table with the message and their count.

 

What I have so far is this query, but it returns a table of code by count, but I need message by count (and all category must be return, even those with count of zero):

 

the search | append [input lookup the csv file]
|stats count by message

I tried to play with fields and table, but I don't get the desired result.

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Why is it necessary to use inputlookup as opposed to lookup, which appears more directly applicable? (And more efficient.)

the search
| stats count by code
| lookup the_csv_file code
| fields - code ``` if you do not want to display code ```

 

0 Karma

MPJ44
Loves-to-Learn Everything

This solution doesn't display code with count value of zero.

Here is a solution I came up with the help of another Splunk thread:

 

the search|
append [|inputlookup file.cvs | table code]
| lookup file.cvs code OUTPUT message| stats count by message

 

This conversion can be closed.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@MPJ44 To close, you can check my answer as solution.  As always, karma is appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...