Translate and overwrite the values of a field

[akr]

I am new to Splunk. I am trying to overwrite the values of a field (eventLevel) that is in Japanese. I created a lookup table to convert these values to English so that the data is more readable. Now, how can I see those translated values in the eventLevel field?

[ITWhisperer]

You could do something like this (this assumes you have at least two fields in your lookup, one called eventlevel (to match your event field) and the other call english_eventlevel)

| lookup translator.csv eventlevel OUTPUT english_eventlevel
| eval eventlevel = coalesce(english_eventlevel, eventlevel)

The coalesce ensures that if there isn't a translation, you keep the original eventlevel