can I give a description to an extracted field?

[rileyken]

I have a GUID field in my logs, and the guid is unique for a specific location. I wanted to query for all events that happen at a specific location so I have to look up the guid value for the location and then search for the guid. Is it possible to use the friendly name for the location to search by instead?

[rileyken]

Thanks, worked like a champ!

[jacobpevans]

You're welcome!

[jacobpevans · Accepted solution]

Greetings Riley,

1. Settings > Lookups > "Add New" next to "Lookup table files"
2. Create a CSV similar to the one below. Upload it with name "GUIDs.csv"
3. Run the search below in the same app that the csv was uploaded in.

GUIDs.csv

GUID,Description
 1,Location 1
 2,Location 2
 3,Location 3
 4,Location 4
 5,Location 5
 6,Location 6
 7,Location 7
 8,Location 8
 9,Location 9
 10,Location 10

Query

| makeresults count=10
| eval   GUID=random()%10
| lookup GUIDs.csv GUID as GUID
| search Description IN ("Location 1", "Location 2", "Location 3")

If anyone in the future finds this post useful, please refer to this link https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup