Splunk Search

Field names in lookup search do not match field names in csv

sc0tt
Builder

I have a lookup file that is recreated daily and the last field is the current date.

item id 2015-03-08
item1 1
item2 2
item3 3

When doing a lookup the date field name does not match the current date value in the csv. It is an older date.

Example :
| inputlookup my_lookup

item id 2015-02-28
item1 1
item2 2
item3 3

Previously, I would get whatever date field was in the csv. When I check the lookup definitions the supported fields are listed as item, id, 2015-02-28. How can I have Splunk return the current date field name in the csv and not the old field name?

Tags (2)
0 Karma
1 Solution

sc0tt
Builder

I agree that having a date field with date value would be ideal, but this is how the file is currently provided. After further investigation, it seems that Splunk was moved to a new directory on the server because of space constraints and the path was set to the old directory. Thanks for your help anyways!

View solution in original post

0 Karma

sc0tt
Builder

I agree that having a date field with date value would be ideal, but this is how the file is currently provided. After further investigation, it seems that Splunk was moved to a new directory on the server because of space constraints and the path was set to the old directory. Thanks for your help anyways!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you considered adding a field date that has the date as a value? Should be much easier to work with later if the field name doesn't change all the time. Also, having the minus operator in a field name can lead to unexpected results.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...