The key to do this is to organize fields from events into an easy-to-access format after the lookup table. Traditionally, Splunkers use mvjoin-split action. But for a highly variable use case like ...
See more...
The key to do this is to organize fields from events into an easy-to-access format after the lookup table. Traditionally, Splunkers use mvjoin-split action. But for a highly variable use case like this, it is almost impossible. You want a structured data representation. Something like, oh, I know, JSON. If you use Splunk 8.1 or later, I recommend this: | tojson output_field=hash
| lookup cases.csv id
| foreach Field1 Field2
[eval output = mvappend(output, '<<FIELD>>' . "=" . json_extract(hash, '<<FIELD>>'))]
| eval output = "id" . id . " Summary " . mvjoin(output, " ")
| table output hash Field1 Field2 This should work with any number of cases. To illustrate the point, this comes from your sample data and sample lookup: output hash Field1 Field2 id1 Summary src_ip=2.2.2.2 dest_ip=1.1.1.1 {"dest_ip":"1.1.1.1","id":1,"src_ip":"2.2.2.2"} src_ip dest_ip id2 Summary user=bob domain=microsoft {"domain":"microsoft","id":2,"user":"bob"} user domain id3 Summary country=usa {"city":"seattle","country":"usa","id":3} country id4 Summary company=cisco product=splunk {"company":"cisco","id":4,"product":"splunk"} company product (Interestingly, if you are pre-8.1, you can replace json_extract with spath - the function, not command, and the search still works in this case.) Here is an emulation for you to play with and compare with real data. | makeresults
| eval data = split("E1: id=1 , dest_ip=1.1.1.1, src_ip=2.2.2.2,.....
E2: id=2, user=bob, domain=microsoft
E3: id=3 country=usa, city=seattle
E4: id=4 company=cisco, product=splunk", "
")
| mvexpand data
| rename data as _raw
| extract
| fields - _*
``` data emulation above ```