Splunk Search

How to make a sequential lookup?

Arcite
Explorer

I have created a CSV from Linux's usb.ids (http://www.linux-usb.org/usb.ids ) that has vendor_id,product_id,VendorDesc,ProductDesc as the first line. I am trying to create a lookup that takes the Vendor Id and Product Id to fill in the Descriptions. When I do the search

... | lookup usb_ids.csv vendor_id AS vendor_id product_id AS product_id OUTPUT VendorDesc, ProductDesc

it works for any value that is unique. For example, vendor_id=04e6 and product_id=5116 does not work; I'm assuming that this happens because vendor_id=0486 appears in both the vendor_id and product_id fields and 5116 matches a few product_ids for different Vendors. Is there a way for it to match BOTH the vendor_id and product_id to get the correct values?

0 Karma
1 Solution

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

View solution in original post

0 Karma

Arcite
Explorer

Although its not the best answer, and I'm hoping someone else can come up with something better, I was able to use eval to create a new id number that included both, reworked the usb_ids.csv file to match this change and it work.

...| eval ID = tostring(vendor_id) + tostring(product_id) | table ID | lookup usb_ids.csv ID as ID OUTPUT description

Another option would be to write a Python script to look it up sequentially and use an external lookup

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...