Splunk Search

Use csv (input/outputlookup) to display label from csv in pie chart

mhornste
Path Finder

Hi,

I have a working search which returns me IDs for specifing meanings of the values. I also have a working inputlookup file which has the sime IDs and the meaning of the IDs. I'd like to display the meaning value from the inputlookup file instead of the IDs. Is this possible?

Search:

index=rc sourcetype=OtcsRemoteCache Operation="1*" 
|  stats count by Operation

alt text

The lookup looks as follows:

OperationCode,Meaning,Direction
1001,Create Document,Remote Cache
1002,Get Version Metadata, Remote Cache
1003,Get Version Metadata from Cache, Remote Cache
1004,Get Version Content,Remote Cache
1005,Get Web Page, Remote Cache
1006,Get Document, Remote Cache
1007,Add Web Pages,Remote Cache
1008,Add Version,Remote Cache
1009,Promote Version,Remote Cache
1010,Delete,Remote Cache
1011,Get SNF for Document ID,Remote Cache
1012,Get Component Stream,Remote Cache
1013,Get Component Stream from Cache,Remote Cache
1014,Set Component Stream,Remote Cache
1015,Get Component Info,Remote Cache
1016,Get Component Info from Cache,Remote Cache
1017,Delete Component,Remote Cache
1018,Create Component,Remote Cache

The following search returns the correct values:
| inputlookup otcs_remote_cache_lookup.csv
| where Direction="Remote Cache"
| table Meaning, OperationCode

How can I display the Meaning field from the lookup in the pie chart instead of the IDs?

Thanks!

Martin

Tags (3)
0 Karma

niketn
Legend

Create a Lookup Definition for otcs_remote_cache_lookup.csv as otcs_remote_cache_lookup from Settings > Lookup > Lookup Definition (grant required permission)

 index=rc sourcetype=OtcsRemoteCache Operation="1*" 
| stats count by Operation
| lookup otcs_remote_cache_lookup OperationCode as Operation output Meaning
| fields - Operation
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...