Splunk Search

REX and Lookups

HealyManTech
Explorer

I am trying to use a lookup table after I rex out some logs.

Here is an example:
index=* source=messages
| rex field=_raw "ACTION:[\w]\s(?.*) CODE"
| outputlookup actions.csv action OUTPUT desc AS desc
| table _time action desc

Can anyone help? Am I doing it wrong?

0 Karma
1 Solution

elliotproebstel
Champion

I think the display is eating some of your rex, so I'm not sure I can troubleshoot that part directly. If it's working at creating a field called action, then you should only need to revise your lookup line:

| lookup actions.csv action OUTPUT desc AS desc

That will work if the events contain a field called action. If they don't, (say, maybe they contain a field called ACTION), then you'd do this:

| lookup actions.csv action AS ACTION OUTPUT desc AS desc

The way you have it now, you are using the command outputlookup, which is used to literally "output a lookup file" (i.e. create a lookup file) rather than to use a lookup file to perform a lookup.

View solution in original post

0 Karma

elliotproebstel
Champion

I think the display is eating some of your rex, so I'm not sure I can troubleshoot that part directly. If it's working at creating a field called action, then you should only need to revise your lookup line:

| lookup actions.csv action OUTPUT desc AS desc

That will work if the events contain a field called action. If they don't, (say, maybe they contain a field called ACTION), then you'd do this:

| lookup actions.csv action AS ACTION OUTPUT desc AS desc

The way you have it now, you are using the command outputlookup, which is used to literally "output a lookup file" (i.e. create a lookup file) rather than to use a lookup file to perform a lookup.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...