Splunk Search

Translation lookup table

ICAP_RND
Engager

I have extraction of a field called Tool (Textual)
The field values can be in English, German, French or Spanish.
I have a lookup table that contains all the options of this values in all those languages (see attached example)
alt text
I want to create a field called TranslatedTool that any event will be translated into english

0 Karma
1 Solution

woodcock
Esteemed Legend

If every string everywhere is completely unique (exceedingly likely), then you can do it like this with successive lookups:

... | lookup ToolLookup English AS Tool OUTPUT English AS TranslatedTool
| lookup ToolLookup French AS Tool OUTPUT English AS TranslatedTool
| lookup ToolLookup German AS Tool OUTPUT English AS TranslatedTool
| lookup ToolLookup Spanish AS Tool OUTPUT English AS TranslatedTool

View solution in original post

0 Karma

Peterman
Explorer

If your event data includes a mixture of languages, a straightforward approach is to restructure your reference table. In this new setup, the first column should encompass all conceivable combinations of "Tools" values, including English. The second column should store the corresponding English translations for each item, denoted as "TranslatedTool."

With this arrangement in place, you can effortlessly incorporate a lookup command into your search process or establish an automated lookup mechanism to generate the "TranslatedTool" field, featuring the accurate English translations.

0 Karma

woodcock
Esteemed Legend

If every string everywhere is completely unique (exceedingly likely), then you can do it like this with successive lookups:

... | lookup ToolLookup English AS Tool OUTPUT English AS TranslatedTool
| lookup ToolLookup French AS Tool OUTPUT English AS TranslatedTool
| lookup ToolLookup German AS Tool OUTPUT English AS TranslatedTool
| lookup ToolLookup Spanish AS Tool OUTPUT English AS TranslatedTool
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

If your events contain mixed languages, the easiest would be to rearrange your lookup table to have column one be all possible permutations of the values for "Tool" (including English) and have column 2 be the English translation for each (TranslatedTool).

Then you can just add a lookup command to your search or define an automatic lookup to create the field TranslatedTool with the proper English translation.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...