Splunk Search

Is it possible to do a lookup based on IF statement?

guimilare
Communicator

Hello Splunkers,
here is my scenario:

I have a field actionType that can assume two values: "S" or "A".
Based on actionType value, I need to do a lookup in different lookup tables.

For example, if actionType is "S", I have to do a lookup with S_actions.csv table; if it is "A", I have to do a lookup with A_actions.csv table.

My first idea was using an if statement, but I was unable to do so.
Any Ideas?

Thank in advance!

Tags (1)
1 Solution

elliotproebstel
Champion

I'd do it like this:

your base search 
| eval s_action=if(actionType="S", Action, NULL), a_action=if(actionType="A", Action, NULL
| lookup S_actions.csv action AS s_action
| lookup A_actions.csv action AS a_action
| fields - s_action a_action

View solution in original post

elliotproebstel
Champion

I'd do it like this:

your base search 
| eval s_action=if(actionType="S", Action, NULL), a_action=if(actionType="A", Action, NULL
| lookup S_actions.csv action AS s_action
| lookup A_actions.csv action AS a_action
| fields - s_action a_action

guimilare
Communicator

Thanks! Exactly what I needed!

0 Karma

elliotproebstel
Champion

Glad to help. 🙂

0 Karma

493669
Super Champion

on selection of action type as "S" or "A", what action needs to be performed on lookup?

0 Karma

guimilare
Communicator

I'll use a second field called "Action" (that's a code, and can be multivalue) and get the action description using the lookup.
Both S and A actionTypes have similar codes (e.g: A1, A2, A3). That's why I need to separate the lookups.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...