is it possible to use json file with csv lookup file?

[anooshac]

Hi all, i have used csv lookup file to csv files to map the values . Can i use json file instead of csv file to map the values from the csv lookup file?

[nickhills]

No, not directly. Lookup FILES only work with CSV files.

You may be able to implement an external lookup with a script which parses your JSON data and returns matched values, but you would need to build this yourself.

Alternativly, you could write the JSON data into the KV store and use a KV lookup instead.
There are a couple of approaches for this, but if the json file is updated frequently, you may just be better finding a repeatable way to convert the json data to CSV.

[anooshac]

Thank you @nickhillscpl , i am yet to explore about these things. Can you please suggest some links to understand these things in a better way.

[nickhills]

CSV Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usefieldlookupstoaddinformationtoyourev...

External Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineanexternallookupinSplunkWeb

KV Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineaKVStorelookupinSplunkWeb

Good luck!

[to4kawa]

|makeresults
| eval _raw="your_json"
| spath
| rename JSON_NESTED_FIELD_NAME AS Clean_Name
| outputcsv your.csv

[nickhills]

@to4kawa read my mind 🙂
This would also work if you are already indexing the json file (or can).

You could even use this approach to populate a kv lookup using |outputlookup