Splunk Search

Is it possible to use a column header as key for a lookup?

HeinzWaescher
Motivator

Hi,

is it possible to use a column header for a lookup?

Let's say that we have a csv like this:

Date | A | B 
01.01.2014| 5 | 2
02.01.2014| 5 | 2
03.01.2014| 5 | 2

Fields in the event:

Date=02.01.2014
Key=A

Now I need the output from the csv:
output=5

For

Date=02.01.2014
Key=B

the output would be 2 and so on...

Thanks in advance

Heinz

Tags (2)
0 Karma

HeinzWaescher
Motivator

Thanks for your comments.

The number of keys will increase in the future and the number of values can vary.

I tried out the transpose command, but this created confusing (not linear lookup) tables.

0 Karma

somesoni2
Revered Legend

Try this

your base search giving Date and Key fields | join Date, Key [|inputlookup yourlookupfile.csv | untable Date Key Value ] | table Date, Key, Value
0 Karma

HeinzWaescher
Motivator

I don't think that this is possible because there is no "key" field. The headers should only be used as key.

I think an easier option is to find a way to convert the crosstable into a list and use this as a lookup afterwards.

Thanks everbody for your input!

0 Karma

splunker12er
Motivator

transpose the rows to column values and try with props & transforms.
Key,Date,Value1,Value2
A,Date,5,2
A,Date,6,2
B,Date,1,3
B,Date,6,2

etc..Use ,

|lookup Date as Date Key as Key OUTPUTFIELD Value1,Value2

0 Karma

somesoni2
Revered Legend

Is the list of values for field 'Key' static and total no of values smaller?

0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...