Splunk Search

Lookup table: Show one or another output

javo
Explorer
Code,Description1,Description2
0,ok,successful
1,error,failure
3,not_connected,not_found
6,unsync,network_error

OK, this is a piece of my .csv file. I have everithing correctly configured in transforms.conf and props.conf.

I need to show in a table the right message to the Code, depending on the value of another field.
For example, the field Key contains only values Blue and Red. If Key is Blue, show Description1; if Key is Red, show Description2.

Continuing with the example, this is what I would want to see in the table while searching:

Code ----------- Key ------------ Description
  0              Red              successful
  1              Red              failure
  0              Blue             ok
  6              Red              network_error
  3              Blue             not_connected
  1              Blue             error

Is there any way to do that?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You should be able to achieve this with a combination of eval and case, something like this:

... | eval Description = case(Key=="Red",Description1,Key=="Blue",Description2)

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should be able to achieve this with a combination of eval and case, something like this:

... | eval Description = case(Key=="Red",Description1,Key=="Blue",Description2)
0 Karma

rgcurry
Contributor

Javo,
When the student is ready, the lesson appears. I have found this to be true for me, and others, over and over again. It seems that "noop" is actually an acronym for "Not Open to Opportunities Presently"! (;->)

0 Karma

javo
Explorer

I was tying that with eval Description = if(Key=Red,Description1,Description2)... How could I not see the '==' noob mistake.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...