Splunk Search

is it possible to use json file with csv lookup file?

Explorer

Hi all, i have used csv lookup file to csv files to map the values . Can i use json file instead of csv file to map the values from the csv lookup file?

Tags (4)
0 Karma

Ultra Champion

No, not directly. Lookup FILES only work with CSV files.

You may be able to implement an external lookup with a script which parses your JSON data and returns matched values, but you would need to build this yourself.

Alternativly, you could write the JSON data into the KV store and use a KV lookup instead.
There are a couple of approaches for this, but if the json file is updated frequently, you may just be better finding a repeatable way to convert the json data to CSV.

0 Karma

Explorer

Thank you @nickhillscpl , i am yet to explore about these things. Can you please suggest some links to understand these things in a better way.

0 Karma

Ultra Champion
|makeresults
| eval _raw="your_json"
| spath
| rename JSON_NESTED_FIELD_NAME AS Clean_Name
| outputcsv your.csv
0 Karma

Ultra Champion

@to4kawa read my mind 🙂
This would also work if you are already indexing the json file (or can).

You could even use this approach to populate a kv lookup using |outputlookup

0 Karma