Splunk Search

Row lookup

deodion
Path Finder

Is there any way to lookup row instead column cell?

For example,
row1: header_a, header_b
row2: value_a, value_b
row3: header_c, header_d
row4: value_c, value_d

| lookup mylookup header_c OUTPUT value_c

Thanks,

Tags (2)
0 Karma

Paolo_Prigione
Builder

You could do this only with a scripted, python-based, lookup command. More infos here. But I suggest you to reformat the file, if possible.

If you were to index your lookup file, then you could use a search to "parse" it into key=value pairs, but you would need a way to identify header rows. In the next sample, the file lup.txt is the following:

header1,header2
value1,value2
header3,header4,header5
value3,value4,value5

and this search:

| file /opt/splunkbeta/etc/apps/search/lookups/lup.txt | eval values=_raw | streamstats first(_raw) as header window=1 current=f | search header="head*" | mappy _raw="; ".join(["=".join(t) for t in zip(header.split(","),values.split(","))]) | extract pairdelim="; " kvdelim="="

produces key-value pairs from that file. It assumes headers start with "head*". You could use this to join with your search, or elaborate on that. Note: you need to assign the use_file_operator privilege to take advantage of the file command.

Another way could be to use the multikv command with the multitable option on. But you will have to reformat the file in any case.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...