Getting Data In

How to read a number, then convert to corresponding string and stats table?

bryceweb22
Path Finder

I am trying to extract a module/level ID from my logs and have splunk take that ID and match it to the corresponding name from a csv file and put that into a stats table, please help.

Thanks!

0 Karma
1 Solution

sandeepmakkena
Contributor

YourSearch | rex field=_raw max_match=0 "level ID":\"(?< ID>\d+)\""
| lookup file.csv level ID as ID OUTPUT corresponding_name
| table corresponding_name count

Save your .csv to lookup folder

file.csv

ID corresponding_name
1 A
2 B

This should work.

View solution in original post

0 Karma

sandeepmakkena
Contributor

YourSearch | rex field=_raw max_match=0 "level ID":\"(?< ID>\d+)\""
| lookup file.csv level ID as ID OUTPUT corresponding_name
| table corresponding_name count

Save your .csv to lookup folder

file.csv

ID corresponding_name
1 A
2 B

This should work.

0 Karma

starcher
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...