{"id":30443,"date":"2022-06-27T12:05:04","date_gmt":"2022-06-27T12:05:04","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=30443"},"modified":"2022-12-23T05:52:34","modified_gmt":"2022-12-23T05:52:34","slug":"splunk-tutorial-lookup","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/splunk-tutorial-lookup\/","title":{"rendered":"Splunk Tutorial: Lookup"},"content":{"rendered":"<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"HTML, XML\" data-shcb-language-slug=\"xml\"><span><code class=\"hljs language-xml\"># Create a csv file\r\n\r\ncolname1,colname2\r\n<span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">val1<\/span>&gt;<\/span>,<span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">val1<\/span>&gt;<\/span> has been converted\r\n<span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">val2<\/span>&gt;<\/span>,<span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">val2<\/span>&gt;<\/span> has been converted\r\n\r\nindex=_internal*\r\n--------\r\nlog_level,colname2\r\nINFO,INFO has been converted\r\nWARN,WARN has been converted\r\n-----\r\nadd this csv file to lookup table\r\n&amp; Give all Permission\r\n---\r\n\r\nindex=_internal* log_level=* | lookup test.csv log_level OUTPUT colname2 | table log_level colname2 \r\nindex=_internal* log_level=* | lookup lookup.csv log_level OUTPUT colname2 | table log_level colname2 \r\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">HTML, XML<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">xml<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-30443","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/30443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=30443"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/30443\/revisions"}],"predecessor-version":[{"id":30444,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/30443\/revisions\/30444"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=30443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=30443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=30443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}