HI Team Is it possible to use the inputlookup of csv file with 7 column and fill the details in those 7 columns using the search command that fetches the data from splunk ?? Examples: My csv ...
See more...
HI Team Is it possible to use the inputlookup of csv file with 7 column and fill the details in those 7 columns using the search command that fetches the data from splunk ?? Examples: My csv looks like this: Column1 , Column2 Value A1 , Value B1 Value A2 , Value B2 Value A3 , Value B3 Value A4, Value B4 I need output like below : Column1 , Column2 , Column3 , Column4 Value A1 , Value B1 , Value C1 , Value D1 Value A2 , Value B2 , Value C2 , Value D2 Value A3 , Value B3 , Value C3 , Value D3 Value A4, Value B4 , Value C4 , Value D4 Values of Column 3 and Column4 are fetched from Splunk using search command and using the key value of Column1. I've tried to use the below search, but it is not working: | inputlookup File.csv | join Column1 type=left [ | tstats latest(Column3) as START_TIME , latest(Column4) as END_TIME where index = main source = xyz ] | table Column1 , Column2 , START_TIME , END_TIME