Splunk Search

Use csv (input/outputlookup) to display label from csv in pie chart

Path Finder


I have a working search which returns me IDs for specifing meanings of the values. I also have a working inputlookup file which has the sime IDs and the meaning of the IDs. I'd like to display the meaning value from the inputlookup file instead of the IDs. Is this possible?


index=rc sourcetype=OtcsRemoteCache Operation="1*" 
|  stats count by Operation

alt text

The lookup looks as follows:

1001,Create Document,Remote Cache
1002,Get Version Metadata, Remote Cache
1003,Get Version Metadata from Cache, Remote Cache
1004,Get Version Content,Remote Cache
1005,Get Web Page, Remote Cache
1006,Get Document, Remote Cache
1007,Add Web Pages,Remote Cache
1008,Add Version,Remote Cache
1009,Promote Version,Remote Cache
1010,Delete,Remote Cache
1011,Get SNF for Document ID,Remote Cache
1012,Get Component Stream,Remote Cache
1013,Get Component Stream from Cache,Remote Cache
1014,Set Component Stream,Remote Cache
1015,Get Component Info,Remote Cache
1016,Get Component Info from Cache,Remote Cache
1017,Delete Component,Remote Cache
1018,Create Component,Remote Cache

The following search returns the correct values:
| inputlookup otcs_remote_cache_lookup.csv
| where Direction="Remote Cache"
| table Meaning, OperationCode

How can I display the Meaning field from the lookup in the pie chart instead of the IDs?



Tags (3)
0 Karma


Create a Lookup Definition for otcs_remote_cache_lookup.csv as otcs_remote_cache_lookup from Settings > Lookup > Lookup Definition (grant required permission)

 index=rc sourcetype=OtcsRemoteCache Operation="1*" 
| stats count by Operation
| lookup otcs_remote_cache_lookup OperationCode as Operation output Meaning
| fields - Operation
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!