Splunk Search

Lookup with fieldname as a value instead of column-header

Muryoutaisuu
Communicator

Hi guys

I have a CSV file with following structure:

+--------+-----------+------------+
| DEV_ID | attr_name | attr_value |
+--------+-----------+------------+
| DEV_1  | field_1   | value_xx   |
| DEV_1  | field_2   | value_yy   |
| DEV_2  | field_1   | value_zz   |
and so on

I want a lookup on DEV_ID in which I can say:
Take the fieldname from attr_name and its value from attr_value and append the fields to all events (as automatic lookups)
In a simple lookup command the fieldname is always the column-header.
Is it possible to change that behaviour and give a cell as fieldname?

0 Karma
1 Solution

Muryoutaisuu
Communicator

Found a different solution.
First I have to manipulate my csv to put it into normal shape (got me some time and this answer to come up with the right search)

| inputlookup attributes.csv | eval {attr_name}=attr_value | fields- attr_name,attr_value | stats first(*) as * by DEV_ID
This results into a "normal" and usable lookup-table which doesn't impose anymore any problems.
Hope this might help others too

View solution in original post

Muryoutaisuu
Communicator

Found a different solution.
First I have to manipulate my csv to put it into normal shape (got me some time and this answer to come up with the right search)

| inputlookup attributes.csv | eval {attr_name}=attr_value | fields- attr_name,attr_value | stats first(*) as * by DEV_ID
This results into a "normal" and usable lookup-table which doesn't impose anymore any problems.
Hope this might help others too

thomrs
Communicator

You can do this with a transform command. Something like this:

[kvpair]
REGEX  = ([a-z]+)=([a-z]+)
FORMAT = $1::$2

Then add to props.

[<sourcetypw>] 
REPORT-syslog  =kvpair

My syntax may not be 100%, but the docs will help you there.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/transformsconf

0 Karma

Muryoutaisuu
Communicator

Thank you for the answer. Sadly this is not helping me.
I'm able to create the transforms stanza:


[attributes]
REGEX = ,(/S+),(.*)$ # backslash instead of /
FORMAT = $1::$2

The props.conf is more difficult. As the data is not indexed but instead in the CSV-file, I can't make the configuration on a specific sourcetype,source or host.
I need the csv-file to append information to a search with the splunk command lookup

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...