Hi guys
I'm not an expert of Splunk.
I was wondering if I can use a lookup to reference fields that are stored into another log file (not csv) indexed in Splunk
Let me explain:
I have a log file indexed in Splunk:
col1,col2,GCD1,col4,col5
col1,col2,GCD2,col4,col5
col1,col2,GCD3,col4,col5
I've another file always indexed in Splunk:
graph [
directed 1
node [
id 1
Node "Node1"
]
node [
id 2
Node "Node2"
]
node [
id 3
Node "Node3"
]
]
I need a new field when I search for the first file that match the GDCID with the id in the second file
col1,col2,GCD1,col4,col5,Node1
col1,col2,GCD2,col4,col5,Node2
col1,col2,GCD3,col4,col5,Node3
Is this possible?
Thanks
The general approach is something like this:
(search identifying data set 1) OR (search identifying data set 2) | stats values(field1) as field1 ... by common_field
The general assumption here is to have one event per "GCDn"
on the left and one event per "id n"
on the right, the stats stitches them together.
In your case you may need to do a bit of preprocessing, for example your first data set seems to have values like "GCD1"
while the second data set appears to have values like "id 1"
- those field values need to be harmonized before the stats, e.g. like this:
() OR () | eval common_field = case(expression identifying data set 1, replace(field_from_data_set_1, "GCD", ""), expression identifying data set 2, replace(field_from_data_set_1, "id ", ""), true(), "unknown id") | stats ...
More background: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...
Even more background: https://wiki.splunk.com/Virtual_.conf March 2016 talk "Best practices around grouping and aggregating data from different search results"