Splunk Search

REX and Lookups

HealyManTech
Explorer

I am trying to use a lookup table after I rex out some logs.

Here is an example:
index=* source=messages
| rex field=_raw "ACTION:[\w]\s(?.*) CODE"
| outputlookup actions.csv action OUTPUT desc AS desc
| table _time action desc

Can anyone help? Am I doing it wrong?

0 Karma
1 Solution

elliotproebstel
Champion

I think the display is eating some of your rex, so I'm not sure I can troubleshoot that part directly. If it's working at creating a field called action, then you should only need to revise your lookup line:

| lookup actions.csv action OUTPUT desc AS desc

That will work if the events contain a field called action. If they don't, (say, maybe they contain a field called ACTION), then you'd do this:

| lookup actions.csv action AS ACTION OUTPUT desc AS desc

The way you have it now, you are using the command outputlookup, which is used to literally "output a lookup file" (i.e. create a lookup file) rather than to use a lookup file to perform a lookup.

View solution in original post

0 Karma

elliotproebstel
Champion

I think the display is eating some of your rex, so I'm not sure I can troubleshoot that part directly. If it's working at creating a field called action, then you should only need to revise your lookup line:

| lookup actions.csv action OUTPUT desc AS desc

That will work if the events contain a field called action. If they don't, (say, maybe they contain a field called ACTION), then you'd do this:

| lookup actions.csv action AS ACTION OUTPUT desc AS desc

The way you have it now, you are using the command outputlookup, which is used to literally "output a lookup file" (i.e. create a lookup file) rather than to use a lookup file to perform a lookup.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...