I have some data in Splunk that I would like to link to some external CSV files
Splunk events have this format
_time, data, link1
The first CSV will be a time based lookup based on link1
dd/mm/yyyy, link1, link2, link3, data2, data3
The second CSV file will be another time based lookup but using data from first CSV to link (link2, link3)
dd/mm/yyyy, link2, link3, data4, data5
So I have have successfully linked the first CSV via this method
http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_...
What I want to know is if these lookups are cumulative?
ie will the second temporal lookup allow the use of results linked from the first lookup?
Or should I just go down the external script lookup route?
Just posting the solution here in case someone else wants to know how it is done
transforms.conf
[customerLookup]
filename=customer-details.csv
time_field=contract_start
time_format = %d/%m/%Y
[chargesLookup]
filename=charges.csv
time_field=date
time_format = %d/%m/%Y
props.conf
[usage-data]
LOOKUP-customerCSV = customerLookup link1 OUTPUT link2 link3 data2 data3
LOOKUP-injectionChargesCSV = chargesLookup link2 link3 OUTPUT data4 data5
It works perfectly so its good to know this is possible.
Just posting the solution here in case someone else wants to know how it is done
transforms.conf
[customerLookup]
filename=customer-details.csv
time_field=contract_start
time_format = %d/%m/%Y
[chargesLookup]
filename=charges.csv
time_field=date
time_format = %d/%m/%Y
props.conf
[usage-data]
LOOKUP-customerCSV = customerLookup link1 OUTPUT link2 link3 data2 data3
LOOKUP-injectionChargesCSV = chargesLookup link2 link3 OUTPUT data4 data5
It works perfectly so its good to know this is possible.
Yes, they will run in sequence. The order is determined by the lexicographic order, so that LOOKUP-a will run before LOOKUP-b.
Ah good to know about the sequence they are run. Thanks
Scratch that is was an issue with my props.conf
IT WORKS!
I just did a test and it doesnt appear to work. But any suggestion on how to achieve this would be great.