Populating Additional Information on Field Data

[chrisschum]

I'm getting log data from a system that uses codes for each entry and I'd like to replace or add a description of the code to my results. There's a big list of codes for the system so I was wondering how I can do that.

Example:
The system logs that User A performed Code A on a user account
The system logs that User B performed Code B on a user account

Code A = User password change
Code B = User address change

Expected results in Splunk search:
User A performed Code A "User password change"
User B performed Code B "User address change"

Thanks!

[richgalloway · Accepted solution]

This is what lookups are for. Create a CSV file ("codes.csv") with your codes and descriptions like this:

Code, Description
A, User password change
B, User address change

Then use the lookup command to get the description from the file at search time.

<your base search> | lookup codes.csv Code OUTPUT Description | table User Code Description

[chrisschum]

Perfect! Thanks!

[chrisschum]

Also, it may not have been clear above but I would like to have a list of the codes and their values and have that list checked when a search is done so that a description of the code populates in the search.