Lookup against an Array

[gbam]

I'm trying to run a lookup against a list of values in an array.  I have a CSV which look as follows:

id	x	y
123	Data	Data2
321	Data	Data2
456	Data3	Data3

The field from the search is is an array which looks as follows:

["123", "321", 456"]

I want to map the lookup value.  Do I need to iterate over the field or can I use a lookup or is the best option?

[tscroggins]

Hi @gbam,

Splunk provides an eval function, json_array_to_mv, to convert JSON-like array values to multivalued field values. After conversion, you can use the lookup command just as you would for any other field:

| makeresults
| eval id="[\"123\", \"321\", \"456\"]"
| eval id=json_array_to_mv(id, false())
| lookup gbam_lookup.csv id

_time	id	x	y
2023-11-10 16:14:53	123 321 456	Data Data Data3	Data2 Data2 Data3

Index 0 of multivalued field id corresponds to index 0 of multivalued fields x and y, index 1 corresponds to index 1, etc.