Splunk Search

Is it possible to use a column header as key for a lookup?

HeinzWaescher
Motivator

Hi,

is it possible to use a column header for a lookup?

Let's say that we have a csv like this:

Date | A | B 
01.01.2014| 5 | 2
02.01.2014| 5 | 2
03.01.2014| 5 | 2

Fields in the event:

Date=02.01.2014
Key=A

Now I need the output from the csv:
output=5

For

Date=02.01.2014
Key=B

the output would be 2 and so on...

Thanks in advance

Heinz

Tags (2)
0 Karma

HeinzWaescher
Motivator

Thanks for your comments.

The number of keys will increase in the future and the number of values can vary.

I tried out the transpose command, but this created confusing (not linear lookup) tables.

0 Karma

somesoni2
Revered Legend

Try this

your base search giving Date and Key fields | join Date, Key [|inputlookup yourlookupfile.csv | untable Date Key Value ] | table Date, Key, Value
0 Karma

HeinzWaescher
Motivator

I don't think that this is possible because there is no "key" field. The headers should only be used as key.

I think an easier option is to find a way to convert the crosstable into a list and use this as a lookup afterwards.

Thanks everbody for your input!

0 Karma

splunker12er
Motivator

transpose the rows to column values and try with props & transforms.
Key,Date,Value1,Value2
A,Date,5,2
A,Date,6,2
B,Date,1,3
B,Date,6,2

etc..Use ,

|lookup Date as Date Key as Key OUTPUTFIELD Value1,Value2

0 Karma

somesoni2
Revered Legend

Is the list of values for field 'Key' static and total no of values smaller?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...