Splunk Search
Highlighted

Lookup more than one column in Lookup Table

New Member

I want to return descriptions I have in a lookup table. The description corresponds to a code in my Events list. However the code is a single digit number between 0 and 9 and the code column in my lookup table has multiple 0's 1's 2's etc. My lookup table has another column 'TYPE' to parse out these codes.

Is it possible to modify the |lookup command to use the code column when the TYPE column has a specified value and return the corresponding DESCRIPTION?

alt text

0 Karma
Highlighted

Re: Lookup more than one column in Lookup Table

Legend

Hi sarahaydenvi,
you can filter lookup results inserting a variable and use as key field two fields, something like this:

index=my_index
| eval TYPE="UPDATE STATE"
| lookup my_lookup.csv CODE TYPE OUTPUT DESCRIPTION
| ...

Bye.
Giuseppe

0 Karma