Lookup search query results to null

[SasiB137]

csv file users_timeout_value_map.csv content.
TIMEOUT,TIMEOUT_VAL

default_timeout,300

transformes.conf

[users_timeout_value_lookup]
filename = users_timeout_value_map.csv
Question
... | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

This always results 1800 as TIMEOUT results to null. Can any one help me plz.

Thanks,
Sasi.

[chimell]

Hi SasiB137
Make sure that TIMEOUT_VAL field is present in the list of your field and that it is a numeric field

[lguinn2 · Accepted solution]

First, the file name is transforms.conf not transformers.conf, but that is probably just a typo.

Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.

If your search results return a field with a different name, then you can use

| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL

to tell Splunk which field to match against the TIMEOUT field of the CSV file.

[SasiB137]

this works :
...| eval TIMEOUT="default_timeout" | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT_VAL),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

[richgalloway]

What do you get from ... | table TIMEOUT TIMEOUT_VAL TIMEOUT_VALUE ?

[SasiB137]

null null 1800