Splunk Search

Need Help with lookup using variable

_-
Observer

Hi,

I have index data as below and i have kvstores per each account which has additional info. 

Example Scenario (account numbers and corresponding kvstores: 
Index data:

AccountIDResourceID
Account1Resource1.1
Account1Resource1.2
Account2Resource2.1
Account2Resource2.2

 

KVStores:

Account1_Collection

ResourceIDIP
Resource1.11.1.0.0
Resource1.21.1.1.1

 

Account2_Collection

ResourceIDIP
Resource2.12.2.0.0
Resource2.22.2.1.1


Required output:

AccountIDResourceIDIP
Account1Resource1.11.1.0.0
Account1Resource1.21.1.1.1
Account2Resource2.12.2.0.0
Account2Resource2.22.2.1.1

 

I used approach mentioned in the answer here Solved: How to use a variable to determine which CSV looku... - Splunk Community

... | eval keyA=if(fieldX="value1"), fieldX, null()) | lookup lookupA keyA
    | eval keyB=if(fieldX="value2"), fieldX, null()) | lookup lookupB keyB
    | eval keyC=if(fieldX="value3"), fieldX, null()) | lookup lookupC keyC

but this approach does not make it dynamic, if i have new value and hence new lookup, i need to update the searches.. I want to make the search dynamically pick the correct lookup based on the value in event.

Thanks in advance,

SN

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Unfortunately you cannot create that type of dynamic lookup as the name is always the text of the lookup, not some indirection through a field name.

You can do this sort of thing using tokens if the SPL is running in a dashboard where the lookup name can be a token, but it is not really a general solution that would work in an event stream where the lookup will be dynamic based on the event data itself.

I have a feeling I have seen this discussed on Splunk ideas, but you could always create a new idea if it does not already exist.

https://ideas.splunk.com/

 

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!