csv file users_timeout_value_map.csv content.
TIMEOUT,TIMEOUT_VAL
[users_timeout_value_lookup]
filename = users_timeout_value_map.csv
Question
... | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE
This always results 1800 as TIMEOUT results to null. Can any one help me plz.
Thanks,
Sasi.
First, the file name is transforms.conf
not transformers.conf, but that is probably just a typo.
Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.
If your search results return a field with a different name, then you can use
| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL
to tell Splunk which field to match against the TIMEOUT field of the CSV file.
Hi SasiB137
Make sure that TIMEOUT_VAL field is present in the list of your field and that it is a numeric field
First, the file name is transforms.conf
not transformers.conf, but that is probably just a typo.
Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.
If your search results return a field with a different name, then you can use
| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL
to tell Splunk which field to match against the TIMEOUT field of the CSV file.
this works :
...| eval TIMEOUT="default_timeout" | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT_VAL),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE
What do you get from ... | table TIMEOUT TIMEOUT_VAL TIMEOUT_VALUE
?
null null 1800