Splunk query CSV lookup table data dynamic query

in application , We may encounter some data information that needs dynamic management , And in spl Dynamically execute queries based on this information . That is to say, in the past, we may put the query conditions directly on | search Carry out later , First, we want to define this condition in lookup in , And then lookup This condition in is appended in | search Back . Of course , This implementation you can use in | search Back , It can also be used by Netease in various splunk After the command line of , Just for the convenience of sorting out functions , So | search For example .

Take the following case as an example ：

In the examinations held by the school , Maybe sometimes the exam is difficult , Sometimes it's less difficult , Then when we judge the grade of students' examination results each time, we need to evaluate it according to the starting difficulty , Instead of simply 60 As the passing line of each exam , So we can put this dynamic rating in one lookup table in , You can modify this after each exam lookup table To realize the evaluation of students' grades .

• establish lookup table

| makeresults
| eval level_condition="grade>80",subject="Math"
| fields - _time
| outputlookup level.csv

• Test data

| makeresults
| eval name="Sam",grade="85",subject="Math"
| table name,grade,subject

• adopt looukp table Use the conditions in as filter conditions

| makeresults
| eval name="Sam",grade="85",subject="Math"
| search
    [| inputlookup level.csv
| eval standard=level_condition." AND subject=".subject
| return $standard]
| fields - _time

  You can see that the filter condition is effective ：

  So in general , To use dynamic acquisition lookup table The data in is directly referenced to spl in , You need to be right about lookup The data in is processed to be directly referenced spl grammar , And then use return $fieldname The way to put splunk After the command line .

You can see the splicing lookup table Result ：

  Of course , Here's just a simple example , In practical application, you can do more complex logical processing according to your own business .