Splunk Search

Using input lookup

MK3
Explorer

Hello,

If I want to use a external file that contains 2 columns C and D and use those mappings to a existing query that displays a table with the value C (so it is like a case statement that gives a D value for each value of C by checking a external csv file); what is wrong in this syntax -

index="...*" "... events{}.name=ResourceCreated | bin _time span=1h | spath "events{}.tags.A" | dedup "events{}.tags.A" |
inputcsv append=t Map.csv | stats D
as D by C | table "events{}.tags.A" "events{}.tags.B" "events{}.tags.C" "events{}.tags.D" _time | collect index=_xyz_summary marker="search_name=\"test_new_query_4cols\""

I get error -

Error in 'stats' command: The number of wildcards between field specifier '*' and rename specifier 'D' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*).

I tried switch case but showing default value always.

Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @MK3 ,

as also @ITWhisperer said, this isn't a valid SPL search, in addition, you should save your csv in a lookup and use the lookup command.

In addition, you cannot put a field in a stats command without a function and you don't need the stats command.

so try something like this:

index="...*" "... events{}.name=ResourceCreated 
| bin _time span=1h 
| spath "events{}.tags.A" 
| rename "events{}.tags.A" AS "A" "events{}.tags.C" AS "C"
| lookup Map.csv C OUTPUT D
| table A B C D _time 
| collect index=_xyz_summary marker="search_name=test_new_query_4cols"

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MK3 ,

as also @ITWhisperer said, this isn't a valid SPL search, in addition, you should save your csv in a lookup and use the lookup command.

In addition, you cannot put a field in a stats command without a function and you don't need the stats command.

so try something like this:

index="...*" "... events{}.name=ResourceCreated 
| bin _time span=1h 
| spath "events{}.tags.A" 
| rename "events{}.tags.A" AS "A" "events{}.tags.C" AS "C"
| lookup Map.csv C OUTPUT D
| table A B C D _time 
| collect index=_xyz_summary marker="search_name=test_new_query_4cols"

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MK3 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that the statement you shared is not valid SPL, perhaps it would be more useful if you shared what you are actually doing (anonymised only where necessary) so we might be able to determine what might be wrong

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...