Splunk Search

Lookup search query results to null

Engager

csv file users_timeout_value_map.csv content.
TIMEOUT,TIMEOUT_VAL

default_timeout,300

transformes.conf

[users_timeout_value_lookup]
filename = users_timeout_value_map.csv
Question
... | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

This always results 1800 as TIMEOUT results to null. Can any one help me plz.

Thanks,
Sasi.

Tags (3)
0 Karma
1 Solution

Legend

First, the file name is transforms.conf not transformers.conf, but that is probably just a typo.

Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.

If your search results return a field with a different name, then you can use

| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL

to tell Splunk which field to match against the TIMEOUT field of the CSV file.

View solution in original post

Motivator

Hi SasiB137
Make sure that TIMEOUT_VAL field is present in the list of your field and that it is a numeric field

0 Karma

Legend

First, the file name is transforms.conf not transformers.conf, but that is probably just a typo.

Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.

If your search results return a field with a different name, then you can use

| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL

to tell Splunk which field to match against the TIMEOUT field of the CSV file.

View solution in original post

Engager

this works :
...| eval TIMEOUT="default_timeout" | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT_VAL),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

0 Karma

SplunkTrust
SplunkTrust

What do you get from ... | table TIMEOUT TIMEOUT_VAL TIMEOUT_VALUE ?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

null null 1800

0 Karma