Splunk Search

How to use a lookup file to create a new field? (Ex: Http Status code and description from csv file -> create new field http_description)

Kukkadapu
Path Finder

Hi ,
How do I create a new field based on the lookup file (csv file has tow columns - status , description). Now I wanted to match the status with the http_status field and create a new field http_status_desc, Or display the http_status with the description from the file.

Can you give me the steps to create?

Thanks,
Mani

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

You can use the eval command to create a new field based on the result of your lookup table.
If you post the query you are running we might be able to help a bit more.

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Eval

View solution in original post

javiergn
SplunkTrust
SplunkTrust

You can use the eval command to create a new field based on the result of your lookup table.
If you post the query you are running we might be able to help a bit more.

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Eval

Kukkadapu
Path Finder

Thanks Javiergn. That worked 🙂

0 Karma

Kukkadapu
Path Finder

Hey Javiergn, I've not yet used any query. I got to know that, I should use Automatic lookups , so a new field with the description is automatically created when the data comes in. But not sure how to do that.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

Take a look at this:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usefieldlookupstoaddinformationtoyoureve...

There's even an example about http status lookups at the bottom.

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...