Splunk Search

Lookup against an Array

gbam
Explorer

I'm trying to run a lookup against a list of values in an array.  I have a CSV which look as follows:

idxy
123DataData2
321DataData2
456Data3Data3

 

The field from the search is is an array which looks as follows:

["123", "321", 456"]

I want to map the lookup value.  Do I need to iterate over the field or can I use a lookup or is the best option?

Labels (4)
0 Karma

tscroggins
Influencer

Hi @gbam,

Splunk provides an eval function, json_array_to_mv, to convert JSON-like array values to multivalued field values. After conversion, you can use the lookup command just as you would for any other field:

| makeresults
| eval id="[\"123\", \"321\", \"456\"]"
| eval id=json_array_to_mv(id, false())
| lookup gbam_lookup.csv id
_time id x y
2023-11-10 16:14:53 123
321
456
Data
Data
Data3
Data2
Data2
Data3

 

Index 0 of multivalued field id corresponds to index 0 of multivalued fields x and y, index 1 corresponds to index 1, etc.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...