Splunk Tutorial: Lookup

# Create a csv file

colname1,colname2
<val1>,<val1> has been converted
<val2>,<val2> has been converted

index=_internal*
--------
log_level,colname2
INFO,INFO has been converted
WARN,WARN has been converted
-----
add this csv file to lookup table
& Give all Permission
---

index=_internal* log_level=* | lookup test.csv log_level OUTPUT colname2 | table log_level colname2 
index=_internal* log_level=* | lookup lookup.csv log_level OUTPUT colname2 | table log_level colname2 

• Author
• Recent Posts

Follow me

Rajesh Kumar

Mentor for DevOps - DevSecOps - SRE - Cloud - Container & Micorservices at Software AG

Join my following certification courses...
- DevOps Certified Professionals (DCP)
- Site Reliability Engineering Certified Professionals (SRECP)
- Master in DevOps Engineering (MDE)
- DevSecOps Certified Professionals (DSOCP)
URL - https://www.devopsschool.com/certification/

My Linkedin - https://www.linkedin.com/in/rajeshkumarin

Follow me

Latest posts by Rajesh Kumar (see all)

• Apache Lucene Query Example - April 8, 2024
• Google Cloud: Step by Step Tutorials for setting up Multi-cluster Ingress (MCI) - April 7, 2024
• What is Multi-cluster Ingress (MCI) - April 7, 2024