I'm getting log data from a system that uses codes for each entry and I'd like to replace or add a description of the code to my results. There's a big list of codes for the system so I was wondering how I can do that.
Example:
The system logs that User A performed Code A on a user account
The system logs that User B performed Code B on a user account
Code A = User password change
Code B = User address change
Expected results in Splunk search:
User A performed Code A "User password change"
User B performed Code B "User address change"
Thanks!
This is what lookups are for. Create a CSV file ("codes.csv") with your codes and descriptions like this:
Code, Description
A, User password change
B, User address change
Then use the lookup
command to get the description from the file at search time.
<your base search> | lookup codes.csv Code OUTPUT Description | table User Code Description
This is what lookups are for. Create a CSV file ("codes.csv") with your codes and descriptions like this:
Code, Description
A, User password change
B, User address change
Then use the lookup
command to get the description from the file at search time.
<your base search> | lookup codes.csv Code OUTPUT Description | table User Code Description
Perfect! Thanks!
Also, it may not have been clear above but I would like to have a list of the codes and their values and have that list checked when a search is done so that a description of the code populates in the search.