Splunk Search

using lookups to rename field values

architkhanna
Path Finder

I have a lookup file severity_lookup with two columns. One having 1,2,3,4 and other having p1,p2,p3,p4.
I need to change 1 to p1 ,2 to p2 likewise.
Any suggestions

woodcock
Esteemed Legend

You can do this in 1 step PROVIDED you have 100% coverage; if you have an input value that is not present in the lookup, it will lose it's value:

... | lookup severity_lookup SevNum OUTPUT SevName AS SevNum

If you might have a gap, then use coalesce like this:

... | lookup severity_lookup SevNum | eval SevNum=coalesce(SevName, SevNum) | fields - SevName
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming your lookup file is a CSV that looks something like this.

SevNum, SevName
1, p1
2, p2
3, p3
4, p4

Then to convert SevNum in your event into SevName in your results, you could do this.

<your base search> | lookup severity_lookup.csv SevNum OUTPUT SevName | ...

Then use the SevName field in the rest of your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi architkhanna,
try something like this (field in search is severity, lookup name is severity_lookup.csv, column1 is severity, column2 is description)

your_search
| lookup severity_lookup.csv severity OUTPUT description
| table _time other_fields severity description

if the field name is different between search and lookup you have to modify the lookup command in

| lookup severity_lookup.csv severity AS severity_field OUTPUT description

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...