Splunk Search

Is it possible to use a column header as key for a lookup?

HeinzWaescher
Motivator

Hi,

is it possible to use a column header for a lookup?

Let's say that we have a csv like this:

Date | A | B 
01.01.2014| 5 | 2
02.01.2014| 5 | 2
03.01.2014| 5 | 2

Fields in the event:

Date=02.01.2014
Key=A

Now I need the output from the csv:
output=5

For

Date=02.01.2014
Key=B

the output would be 2 and so on...

Thanks in advance

Heinz

Tags (2)
0 Karma

HeinzWaescher
Motivator

Thanks for your comments.

The number of keys will increase in the future and the number of values can vary.

I tried out the transpose command, but this created confusing (not linear lookup) tables.

0 Karma

somesoni2
Revered Legend

Try this

your base search giving Date and Key fields | join Date, Key [|inputlookup yourlookupfile.csv | untable Date Key Value ] | table Date, Key, Value
0 Karma

HeinzWaescher
Motivator

I don't think that this is possible because there is no "key" field. The headers should only be used as key.

I think an easier option is to find a way to convert the crosstable into a list and use this as a lookup afterwards.

Thanks everbody for your input!

0 Karma

splunker12er
Motivator

transpose the rows to column values and try with props & transforms.
Key,Date,Value1,Value2
A,Date,5,2
A,Date,6,2
B,Date,1,3
B,Date,6,2

etc..Use ,

|lookup Date as Date Key as Key OUTPUTFIELD Value1,Value2

0 Karma

somesoni2
Revered Legend

Is the list of values for field 'Key' static and total no of values smaller?

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...