Splunk Search

Using input lookup

MK3
Explorer

Hello,

If I want to use a external file that contains 2 columns C and D and use those mappings to a existing query that displays a table with the value C (so it is like a case statement that gives a D value for each value of C by checking a external csv file); what is wrong in this syntax -

index="...*" "... events{}.name=ResourceCreated | bin _time span=1h | spath "events{}.tags.A" | dedup "events{}.tags.A" |
inputcsv append=t Map.csv | stats D
as D by C | table "events{}.tags.A" "events{}.tags.B" "events{}.tags.C" "events{}.tags.D" _time | collect index=_xyz_summary marker="search_name=\"test_new_query_4cols\""

I get error -

Error in 'stats' command: The number of wildcards between field specifier '*' and rename specifier 'D' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*).

I tried switch case but showing default value always.

Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @MK3 ,

as also @ITWhisperer said, this isn't a valid SPL search, in addition, you should save your csv in a lookup and use the lookup command.

In addition, you cannot put a field in a stats command without a function and you don't need the stats command.

so try something like this:

index="...*" "... events{}.name=ResourceCreated 
| bin _time span=1h 
| spath "events{}.tags.A" 
| rename "events{}.tags.A" AS "A" "events{}.tags.C" AS "C"
| lookup Map.csv C OUTPUT D
| table A B C D _time 
| collect index=_xyz_summary marker="search_name=test_new_query_4cols"

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MK3 ,

as also @ITWhisperer said, this isn't a valid SPL search, in addition, you should save your csv in a lookup and use the lookup command.

In addition, you cannot put a field in a stats command without a function and you don't need the stats command.

so try something like this:

index="...*" "... events{}.name=ResourceCreated 
| bin _time span=1h 
| spath "events{}.tags.A" 
| rename "events{}.tags.A" AS "A" "events{}.tags.C" AS "C"
| lookup Map.csv C OUTPUT D
| table A B C D _time 
| collect index=_xyz_summary marker="search_name=test_new_query_4cols"

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MK3 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that the statement you shared is not valid SPL, perhaps it would be more useful if you shared what you are actually doing (anonymised only where necessary) so we might be able to determine what might be wrong

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...