Splunk Search

How do you retrieve particular data from one field?

ramesh12345
Explorer

Hi,

i have a CSV file that contains a few persons names and teamname(column names is "name" and "Team"). The team name is the same for all in the CSV file. Now, I want to display the name of the person who is raised from the CSV file.

Ex: CSV file contains

name Team
raju Testing
ramesh Testing
rakesh Testing

if my assigned_to have
Richard
Robart
ramesh
raju

i want to display the last person who is changed from the assigned_to. Here is i want "ramesh" should display.Please help how to do this?

index="one" sourcetype="generated"  Number=* status=*  group=* |dedup _time,Number,group |streamstats current=f last(group) as Group, last(visible) as  Visible last(assigned_to) as Assigned_to by Number|lookup test.csv name as assigned_to OUTPUT Team| eval raised= if(group!=Group AND group="Testing Team",1,NULL) | stats count(raised) AS "Raised Cases" by assigned_to,Team| fields - Team
0 Karma

markusspitzli
Communicator

Hi

Why dont you filter the events with the CSV with the inputlookup command? In this way you only get the events where assigned_to contains only those people of your list.

index="one" sourcetype="generated"  Number=* status=*  group=* [ | inputlookup test.csv | field name | rename name as assigned_to ]

Would that help?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...