Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to make a sequential lookup?

$
0
0
I have created a CSV from Linux's usb.ids (http://www.linux-usb.org/usb.ids ) that has **vendor_id,product_id,VendorDesc,ProductDesc** as the first line. I am trying to create a lookup that takes the Vendor Id and Product Id to fill in the Descriptions. When I do the search ... | lookup usb_ids.csv vendor_id AS vendor_id product_id AS product_id OUTPUT VendorDesc, ProductDesc it works for any value that is unique. For example, vendor_id=04e6 and product_id=5116 does not work; I'm assuming that this happens because vendor_id=0486 appears in both the vendor_id and product_id fields and 5116 matches a few product_ids for different Vendors. Is there a way for it to match BOTH the vendor_id and product_id to get the correct values?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>