Splunk Search

How do I combine data from CSV with data from index

WXY
Path Finder

Now ,I have a lookup named exchange.csv , and index="exchange_data"
The data in the exchange.csv is extracted from index="exchange_data"It contains the fields extracted from the index data :

Sys_Name         App_Name
sys1              app1
sys2              app2

such as :
alt text
there are fields in the index="exchange_data" : ID,priority;
I want to get a table contains : ID ,priority, sysname ,appname
such as :
alt text
How can I combine them?

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @wxy,

Did either of the answers below solve your problem? If so, please resolve this post by approving one of them!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

jkat54
SplunkTrust
SplunkTrust

If 0 fields in the csv match 0 fields in your data. Then you’ll not be able to use the lookup in a traditional manner.

Instead you could do this

| inputlookup yourloolup.csv
| append [ search index=exchange_data]

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this

index=exchange_data | lookup exchange.csv Sys_Name as host OUTPUT App_Name | table _time ID, Priority Sys_Name, App_Name

You have to have a field in your data that matches a field in your lookup.
They must match the field name and the value with cAsE sensitivity.

If Sys_Name matches the host field in your exchange_data index then my search above would work fine. If you don’t have any fields in your data that match your lookup, you can’t really use the lookup.

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Lookup

0 Karma

WXY
Path Finder

And the fields in the exchange.csv are custom and do not exist in the data. The field value is in the data

0 Karma

WXY
Path Finder

but I can only use this command :|inputcsv
Other commands cannot query my csv file

0 Karma

ddrillic
Ultra Champion

Interesting command this inputcsv command -

inputcsv

It says -

For Splunk Enterprise deployments, loads search results from the specified .csv file, which is not modified. The filename must refer to a relative path in $SPLUNK_HOME/var/run/splunk/csv (or $SPLUNK_HOME/var/run/splunk/dispatch// if dispatch = true). If the specified file does not exist and the filename does not have an extension, then the Splunk software assumes it has a filename with a .csv extension.

0 Karma

WXY
Path Finder

I know this .But I can not use it to associate exchange.csv with index = exchange_data

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...