Splunk Search

How to retrieve value from lookup for multivalue field

NAGA4
Engager

I have a lookup like this 

NameStatusExamID
JohnPass123
BobPass345
JohnFail234
BobPass235
SmithFail231

 

My Events are having Name alone as the unique identifier.  

I wrote my query like this 

index=userdata [ inputlookup userinfo.csv | fields Name]  | lookup userinfo.csv Name as Name OUTPUT Status as Status ExamID as Identifier 

Via first subsearch I extracted the events only belong to names present in the table and then i tried to ouput the status and examid for those Names. On combination of these 3 in the event i need to evaluate fourth result. 

John - Pass - 123 ->> In this if ExamID falls between 120 and 125 I need to print value for fourth field as "GOOD" 

However while am printing output from lookup i got multivalues like this. Then i tried to do mvappend and that did not work correctly. 

So how to do this correctly

John

Pass

Fail

123

234

Labels (2)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Wait a second. What does it have to do with any events returned from the index? So far you're only operating on the data from the lookup.

Also, unless for displaying (but even then it's... a disputable practice), you don't want to merge values into multivalued fields this way. You'll effectively get two multivalued fields with no connection between them whatsoever. So if you wanted to sort one of them (for example to list passed exams before failed ones or vice-versa) you can't reorder the other field the same way. They are just two separate fields with multivalued contents but there is no relationship between those contents.

(and should any of those values prove to be empty, the whole field will "squash" so you will not have any spaces between values).

0 Karma

NAGA4
Engager

Thank you @PickleRick . Here is the detailed background of my requirement. I need to refer the values from lookup and compare it with values in events for same field and derive the other field

https://community.splunk.com/t5/Splunk-Search/Help-with-splunk-search-query/m-p/685039#M233782

 

0 Karma

andrew_nelson
Communicator

Try something like this: 

<your search> ... 
| eval exam_result=mvzip(ExamID, Status, "~") 
| fields - ExamID Status
| mvexpand exam_result 
| eval ExamID=mvindex(split(exam_result, "~"), 0), Status=mvindex(split(exam_result, "~"), 1)
| eval extra_status = if(ExamID>=120 AND ExamID<=125 AND match(Status, "Pass"), "GOOD", null())



0 Karma

deepakc
Path Finder

Try this

| inputlookup userinfo
| eval fourth_result=if(ExamID>=120 AND ExamID<=125,"GOOD","OTHER")
0 Karma

NAGA4
Engager

I need to do this for multivalues which is not working. 

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...