Splunk Search

Lookup using an indexed log file

faustf
Communicator

Hi guys

I'm not an expert of Splunk.
I was wondering if I can use a lookup to reference fields that are stored into another log file (not csv) indexed in Splunk

Let me explain:
I have a log file indexed in Splunk:

col1,col2,GCD1,col4,col5
col1,col2,GCD2,col4,col5
col1,col2,GCD3,col4,col5

I've another file always indexed in Splunk:

graph [
    directed 1
    node [
        id 1
        Node "Node1"
    ]
    node [
        id 2
        Node "Node2"
    ]
    node [
        id 3
        Node "Node3"
    ]
]

I need a new field when I search for the first file that match the GDCID with the id in the second file

 col1,col2,GCD1,col4,col5,Node1
 col1,col2,GCD2,col4,col5,Node2
 col1,col2,GCD3,col4,col5,Node3

Is this possible?
Thanks

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The general approach is something like this:

(search identifying data set 1) OR (search identifying data set 2) | stats values(field1) as field1 ... by common_field

The general assumption here is to have one event per "GCDn" on the left and one event per "id n" on the right, the stats stitches them together.

In your case you may need to do a bit of preprocessing, for example your first data set seems to have values like "GCD1" while the second data set appears to have values like "id 1" - those field values need to be harmonized before the stats, e.g. like this:

() OR () | eval common_field = case(expression identifying data set 1, replace(field_from_data_set_1, "GCD", ""), expression identifying data set 2, replace(field_from_data_set_1, "id ", ""), true(), "unknown id") | stats ...

More background: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...
Even more background: https://wiki.splunk.com/Virtual_.conf March 2016 talk "Best practices around grouping and aggregating data from different search results"

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...