Splunk Search

Lookup against an Array

gbam
Explorer

I'm trying to run a lookup against a list of values in an array.  I have a CSV which look as follows:

idxy
123DataData2
321DataData2
456Data3Data3

 

The field from the search is is an array which looks as follows:

["123", "321", 456"]

I want to map the lookup value.  Do I need to iterate over the field or can I use a lookup or is the best option?

Labels (4)
0 Karma

tscroggins
Influencer

Hi @gbam,

Splunk provides an eval function, json_array_to_mv, to convert JSON-like array values to multivalued field values. After conversion, you can use the lookup command just as you would for any other field:

| makeresults
| eval id="[\"123\", \"321\", \"456\"]"
| eval id=json_array_to_mv(id, false())
| lookup gbam_lookup.csv id
_time id x y
2023-11-10 16:14:53 123
321
456
Data
Data
Data3
Data2
Data2
Data3

 

Index 0 of multivalued field id corresponds to index 0 of multivalued fields x and y, index 1 corresponds to index 1, etc.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...