Splunk Search

Using Lookup csv file to query fieldname

chrismatt02
Explorer

I have a lookup file saved with a single column having values of specific fields in it. And want to use to search in query which matched with values in field names

Example:

lookupname : test.csv
column name: column1

fieldname: field1

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

See syntax help in lookup.  This is what I suggest:

| lookup column1 AS field1 test.csv output column1 as match
| where isnotnull(match)

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

See syntax help in lookup.  This is what I suggest:

| lookup column1 AS field1 test.csv output column1 as match
| where isnotnull(match)

ITWhisperer
SplunkTrust
SplunkTrust

This is a bit vague. Can you give an example of the type of search you are trying / wanting to do with your lookup?

0 Karma

chrismatt02
Explorer

@ITWhisperer I am using lookup file with single column, multiple entries which contains filenames. I am trying to match that names with the Filename field in query to obtain results which matches the value.


0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. But do you have just one column with multiple values? Or do you have multiple columns? How would your lookup contents match the data you want to search for?

0 Karma

chrismatt02
Explorer

@PickleRick I am using single column multiple entries and just trying to compare values in lookup file with the logs which contains those values and output the results

0 Karma

PickleRick
SplunkTrust
SplunkTrust

With a relatively dense search the approach shown by @yuanliu is the most typical thing to do.

But if you expect that the search will be sparse, you might want to use the lookup by means of a subsearch to generate a set of conditions directly into your search

<your_base_search> [ | inputlookup your_lookup.csv | rename if needed ]
| <rest_of_your_search>

This might prove to be more effective if your resulting set of conditions is small and yields only a handful of events.

Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...