- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: is it possible to use json file with csv looku...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it possible to use json file with csv lookup file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, not directly. Lookup FILES only work with CSV files.
You may be able to implement an external lookup with a script which parses your JSON data and returns matched values, but you would need to build this yourself.
Alternativly, you could write the JSON data into the KV store and use a KV lookup instead.
There are a couple of approaches for this, but if the json file is updated frequently, you may just be better finding a repeatable way to convert the json data to CSV.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @nickhillscpl , i am yet to explore about these things. Can you please suggest some links to understand these things in a better way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
CSV Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usefieldlookupstoaddinformationtoyourev...
External Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineanexternallookupinSplunkWeb
KV Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineaKVStorelookupinSplunkWeb
Good luck!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
|makeresults
| eval _raw="your_json"
| spath
| rename JSON_NESTED_FIELD_NAME AS Clean_Name
| outputcsv your.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@to4kawa read my mind 🙂
This would also work if you are already indexing the json file (or can).
You could even use this approach to populate a kv lookup using |outputlookup
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
Updated Team Landing Page in Splunk Observability
