Thanks for this. I was looking for a solution for this problem, all I found was that it was impossible. Rangemap was a suggestion but my ID field is not numeric. This works fine!
I finally resolved it with the whole csv tranformed to a 201 option case statement, which is performing better. The data in the csv is static, so in this case that could be achieved very easily.
Hi Sir, for this case, the search is done line by line or it is running any other algorithm like binary search? coz some time the lookup table could be huge and searching line by line could consumes a lot of time. Thx
Hi Huaxin, In this case the search will run line by line, thats why map command is not recommended for huge volume of data. As it is recommended that in csv lookups we should not store huge volume of data in that perspective this solution may be ok. Sid
Hi Ajit, you can refer education.splunk.com there you have to register and I believe you have videos for splunk user and poweruser which explains clearly basic spl. That's a good stuff.
Hi Siddhartha Sir, I have been recently moved to Splunk and your videos are really helpful and learnt so many things through them.....I kindly request you to put some videos on SPL complex queries!!!!!!!!!!!!!!! If possible kindly share your email id ...Thanks in advance !!!!!!!!!!!! Already liked and click the Subscription button..
Thanks Sathya....Glad that these videos are helping you...You can find my email id at the about page of this channel. Regarding complex SPL queries I frequently posts different problem solving videos faced by real world users. Some complex queries will be part of those videos.
Thanks for this. I was looking for a solution for this problem, all I found was that it was impossible. Rangemap was a suggestion but my ID field is not numeric. This works fine!
I finally resolved it with the whole csv tranformed to a 201 option case statement, which is performing better. The data in the csv is static, so in this case that could be achieved very easily.
Hi Sir, for this case, the search is done line by line or it is running any other algorithm like binary search? coz some time the lookup table could be huge and searching line by line could consumes a lot of time. Thx
Hi Huaxin,
In this case the search will run line by line, thats why map command is not recommended for huge volume of data. As it is recommended that in csv lookups we should not store huge volume of data in that perspective this solution may be ok.
Sid
@@splunk_ml noted thx
Bro, Need help to compare lookup file field value with the event field value. Anyone can help me on it ?
Sir, please make a video for How we can write SPL
Sure...!!
Hi Ajit, you can refer education.splunk.com there you have to register and I believe you have videos for splunk user and poweruser which explains clearly basic spl. That's a good stuff.
How do we forward logs from FreeNAS to splunk?
You can check out this splubkbase app
splunkbase.splunk.com/app/2940/
Hi could you please make a video on kV store lookup and work flow model?
Sure...!!
Hi Siddhartha Sir, I have been recently moved to Splunk and your videos are really helpful and learnt so many things through them.....I kindly request you to put some videos on SPL complex queries!!!!!!!!!!!!!!! If possible kindly share your email id ...Thanks in advance !!!!!!!!!!!! Already liked and click the Subscription button..
Thanks Sathya....Glad that these videos are helping you...You can find my email id at the about page of this channel. Regarding complex SPL queries I frequently posts different problem solving videos faced by real world users. Some complex queries will be part of those videos.
@@splunk_ml thank you sir.... keep posting!!!!