Splunk Search

Is it possible to use a column header as key for a lookup?

HeinzWaescher
Motivator

Hi,

is it possible to use a column header for a lookup?

Let's say that we have a csv like this:

Date | A | B 
01.01.2014| 5 | 2
02.01.2014| 5 | 2
03.01.2014| 5 | 2

Fields in the event:

Date=02.01.2014
Key=A

Now I need the output from the csv:
output=5

For

Date=02.01.2014
Key=B

the output would be 2 and so on...

Thanks in advance

Heinz

Tags (2)
0 Karma

HeinzWaescher
Motivator

Thanks for your comments.

The number of keys will increase in the future and the number of values can vary.

I tried out the transpose command, but this created confusing (not linear lookup) tables.

0 Karma

somesoni2
Revered Legend

Try this

your base search giving Date and Key fields | join Date, Key [|inputlookup yourlookupfile.csv | untable Date Key Value ] | table Date, Key, Value
0 Karma

HeinzWaescher
Motivator

I don't think that this is possible because there is no "key" field. The headers should only be used as key.

I think an easier option is to find a way to convert the crosstable into a list and use this as a lookup afterwards.

Thanks everbody for your input!

0 Karma

splunker12er
Motivator

transpose the rows to column values and try with props & transforms.
Key,Date,Value1,Value2
A,Date,5,2
A,Date,6,2
B,Date,1,3
B,Date,6,2

etc..Use ,

|lookup Date as Date Key as Key OUTPUTFIELD Value1,Value2

0 Karma

somesoni2
Revered Legend

Is the list of values for field 'Key' static and total no of values smaller?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...