using lookups to rename field values

[architkhanna]

I have a lookup file severity_lookup with two columns. One having 1,2,3,4 and other having p1,p2,p3,p4.
I need to change 1 to p1 ,2 to p2 likewise.
Any suggestions

[woodcock]

You can do this in 1 step PROVIDED you have 100% coverage; if you have an input value that is not present in the lookup, it will lose it's value:

... | lookup severity_lookup SevNum OUTPUT SevName AS SevNum

If you might have a gap, then use coalesce like this:

... | lookup severity_lookup SevNum | eval SevNum=coalesce(SevName, SevNum) | fields - SevName

[richgalloway]

Assuming your lookup file is a CSV that looks something like this.

SevNum, SevName
1, p1
2, p2
3, p3
4, p4

Then to convert SevNum in your event into SevName in your results, you could do this.

<your base search> | lookup severity_lookup.csv SevNum OUTPUT SevName | ...

Then use the SevName field in the rest of your query.

[gcusello]

Hi architkhanna,
try something like this (field in search is severity, lookup name is severity_lookup.csv, column1 is severity, column2 is description)

your_search
| lookup severity_lookup.csv severity OUTPUT description
| table _time other_fields severity description

if the field name is different between search and lookup you have to modify the lookup command in

| lookup severity_lookup.csv severity AS severity_field OUTPUT description

Bye.
Giuseppe