Splunk Search

commas in lookup tables

stephen123
Path Finder

hi, I am using a look-up table, however some of the fields have commas in them. - as you would expect these do not match. Any idea how to get around this,

I have tried adding a \ before the comma but this does not help
I can not remove the comma as this will not match the data

Thanks

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

If you can edit the CSV that you are using as a lookup directely, have you tried including the offending field in quotations (e.g. "). For example:

field0, field1, field2
efuieb, "foo,bar", blah
inevei, "foo", blah

Hope this helps.

MHibbin

View solution in original post

HeinzWaescher
Motivator

Hi,

I've got another comma problem with a lookup. I would like to create a lookup for field values in the eventdata like Test,A, which i want to replace with a new value.

My lookuptable looks like this:

"Test,A" - New Value

I used the quotes to achieve, that the value is not splitted up in the lookup. But then I'm not able to use the lookup, because there is no match. The values in the eventdata don't have quotes...

Any ideas how to achieve my goal?

Thanks, Heinz

0 Karma

MHibbin
Influencer

If you can edit the CSV that you are using as a lookup directely, have you tried including the offending field in quotations (e.g. "). For example:

field0, field1, field2
efuieb, "foo,bar", blah
inevei, "foo", blah

Hope this helps.

MHibbin

stephen123
Path Finder

awesome - thanks

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...