Splunk Search

is it possible to use json file with csv lookup file?

anooshac
Communicator

Hi all, i have used csv lookup file to csv files to map the values . Can i use json file instead of csv file to map the values from the csv lookup file?

Tags (4)
0 Karma

nickhills
Ultra Champion

No, not directly. Lookup FILES only work with CSV files.

You may be able to implement an external lookup with a script which parses your JSON data and returns matched values, but you would need to build this yourself.

Alternativly, you could write the JSON data into the KV store and use a KV lookup instead.
There are a couple of approaches for this, but if the json file is updated frequently, you may just be better finding a repeatable way to convert the json data to CSV.

If my comment helps, please give it a thumbs up!

anooshac
Communicator

Thank you @nickhillscpl , i am yet to explore about these things. Can you please suggest some links to understand these things in a better way.

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval _raw="your_json"
| spath
| rename JSON_NESTED_FIELD_NAME AS Clean_Name
| outputcsv your.csv

nickhills
Ultra Champion

@to4kawa read my mind 🙂
This would also work if you are already indexing the json file (or can).

You could even use this approach to populate a kv lookup using |outputlookup

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...