Hi,
I would like to upload a csv file as a lookup table. what will be header format?
Assuming I have a search field called customer_id. So jsmith means John Smith.
Can you use this as an example to provide a one line csv file?
I trtied jsmith, John Smith
but didn't work out.
Thanks!
Example lookup configuration in the docs. Create your file like this and then follow the links below for an example on how to set it up and then how they get used in searches.
customer_id, customer_name
jsmith,John Smith
http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources
Example lookup configuration in the docs. Create your file like this and then follow the links below for an example on how to set it up and then how they get used in searches.
customer_id, customer_name
jsmith,John Smith
http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources
Because customer_name and firm will always have the same 1:1 mapping (right?) you can just do
... | top customer_name,firm
Good anwser. Thanks!
Assuming the lookup csv file contains the customer's associated firm. e.g.
customer_id, customer_name, customer_firm
jsmith,John Smith,Google
What will be the search string to see top 10 users' name and firm?
The search below will display name, count, percentage.
sourcetype="access_common" | top customer_name
This is covered very well in the docs - I could write examples here but really the docs explain it all: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Exampl...