Splunk Search

Lookup search query results to null

Engager

csv file users_timeout_value_map.csv content.
TIMEOUT,TIMEOUT_VAL

default_timeout,300

transformes.conf

[users_timeout_value_lookup]
filename = users_timeout_value_map.csv
Question
... | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

This always results 1800 as TIMEOUT results to null. Can any one help me plz.

Thanks,
Sasi.

Tags (3)
0 Karma
1 Solution

Legend

First, the file name is transforms.conf not transformers.conf, but that is probably just a typo.

Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.

If your search results return a field with a different name, then you can use

| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL

to tell Splunk which field to match against the TIMEOUT field of the CSV file.

View solution in original post

Motivator

Hi SasiB137
Make sure that TIMEOUT_VAL field is present in the list of your field and that it is a numeric field

0 Karma

Legend

First, the file name is transforms.conf not transformers.conf, but that is probably just a typo.

Second, you are showing what is in the CSV file, but what is in the search results? The lookup command expects that your search results will include a field named TIMEOUT that can be used in the lookup. if the search results do not contain this field, then you will always get a result of 18000.

If your search results return a field with a different name, then you can use

| lookup users_timeout_value_lookup TIMEOUT as yourfieldname OUTPUT TIMEOUT_VAL

to tell Splunk which field to match against the TIMEOUT field of the CSV file.

View solution in original post

Engager

this works :
...| eval TIMEOUT="default_timeout" | lookup users_timeout_value_lookup TIMEOUT OUTPUT TIMEOUT_VAL | eval TIMEOUT_VALUE=if(isnull(TIMEOUT_VAL),18000,TIMEOUT_VAL*60) | table TIMEOUT_VALUE

0 Karma

SplunkTrust
SplunkTrust

What do you get from ... | table TIMEOUT TIMEOUT_VAL TIMEOUT_VALUE ?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

null null 1800

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!