Lookup csv file

[shangshin]

Hi,
I would like to upload a csv file as a lookup table. what will be header format?
Assuming I have a search field called customer_id. So jsmith means John Smith.
Can you use this as an example to provide a one line csv file?

I trtied jsmith, John Smith
but didn't work out.

Thanks!

[sdaniels · Accepted solution]

Example lookup configuration in the docs. Create your file like this and then follow the links below for an example on how to set it up and then how they get used in searches.

customer_id, customer_name
jsmith,John Smith

http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources

[Ayn]

Because customer_name and firm will always have the same 1:1 mapping (right?) you can just do

... | top customer_name,firm

[shangshin]

Good anwser. Thanks!

Assuming the lookup csv file contains the customer's associated firm. e.g.
customer_id, customer_name, customer_firm
jsmith,John Smith,Google

What will be the search string to see top 10 users' name and firm?
The search below will display name, count, percentage.
sourcetype="access_common" | top customer_name

[Ayn]

This is covered very well in the docs - I could write examples here but really the docs explain it all: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Exampl...