I have log files that contain compCodes (over 500 different types of them). Is there a way I can create a mapping from a txt file, so when I query for the results, say:
stats count by compCodes
Can I use the file to map those and replace the compCodes to more meaningful names? (this is intended for an input populated drop-down search)
Yes, you can create a a lookup csv file and use the | lookup
command, or a join, or a whole bunch of other ways.
Assuming the file is mylookup.csv and has fields TheCode and TheDescription ...
| stats count as TheCount by compCodes
| lookup mylookup.csv TheCode as compCodes OUTPUT TheDescription as compDescription
| table CompCodes compDescription TheCount
...or...
| stats count as TheCount by compCodes
| rename compCodes to TheCode
| inputlookup append=t mylookup.csv
| stats values(*) as * by TheCode
| table TheCode TheDescription TheCount
Yes, you can create a a lookup csv file and use the | lookup
command, or a join, or a whole bunch of other ways.
Assuming the file is mylookup.csv and has fields TheCode and TheDescription ...
| stats count as TheCount by compCodes
| lookup mylookup.csv TheCode as compCodes OUTPUT TheDescription as compDescription
| table CompCodes compDescription TheCount
...or...
| stats count as TheCount by compCodes
| rename compCodes to TheCode
| inputlookup append=t mylookup.csv
| stats values(*) as * by TheCode
| table TheCode TheDescription TheCount