Splunk Search

Lookup Table and csv file

anwarmian
Communicator

This is not a question. I just wanted to put two cents worth of my experience with a lookup table and a csv file. This lookup table was able to match some values from a field and not others. What I ended up discovering that one of the rows in the lookup table had an extra field and that was messing up every lookup after that. So if you have a csv file please open it in a spreadsheet and check to make sure that all the rows line up properly with the columns.

Example:

"Country_Code","Country_Name","Continent"
"CN", "CHINA","ASIA"
"ES", "SPAIN", "","EUROPE"
"UK", "UNITED KINGDOM", "EUROPE"

In the above example since SPAIN has an additional column any lookup after SPAIN will provide either a blank or a default value that you used in creating the lookup. This is strictly from my experience. I'll be happy to get feedback from others.

Tags (2)

woodcock
Esteemed Legend

The same thing will happen if you have unmatched (unterminated) parentheses.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...