Splunk Search

lookup returns multivalue on match of single field?

jbanAtSplunk
Communicator

Hi,

Strange behavior with Automatic lookup (same with manual lookup).

I have csv file that contains codes, example:

1 - LOGIN

2 - FAILURE

11 - CERTIFICATE

12 - SOMETHING

...

 

I have lookup

LOOKUP-event_code_action_lookup = event_code_action_lookup event_code AS EventCode OUTPUT event_code_action AS EventCodeAction

when I got results I have multiple EventCodeAction statistics, basically. Events x2 EventCodeAction count?

Why did I doubled EventCodeAction in results?

Original data is json that is parsed
INDEXED_EXTRACTIONS = json
KV_MODE = json
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = 0
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%Q
category = Structured
description = JavaScript Object Notation format. For more information, visit http://json.org/
pulldown_type = 1

 

Also, is it possible to add EventCodeAction in "original json" as field, so it's not only visible on the left sides where the fields are?

Labels (2)
0 Karma
1 Solution

jbanAtSplunk
Communicator

It was my mistake

INDEXED_EXTRACTIONS = json
KV_MODE = json

should be
INDEXED_EXTRACTIONS = json
KV_MODE = none

after that. all works fine

View solution in original post

Tags (1)
0 Karma

jbanAtSplunk
Communicator

And I put in transform.conf

filename = event_code_actions.csv
max_matches = 1

0 Karma

jbanAtSplunk
Communicator

It was my mistake

INDEXED_EXTRACTIONS = json
KV_MODE = json

should be
INDEXED_EXTRACTIONS = json
KV_MODE = none

after that. all works fine

Tags (1)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...