Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Return value from separate fields

$
0
0

Hello,

I'm looking for a solution to get data from two CSV files that will be used for a one-off search.

I have the following data:

CSV 1

  1. displayName=Full User's Name (e.g. "John Doe")
  2. ManagerRACF= The Manager's User ID (e.g. Jdoe002)
  3. sAMAccountName=User's User ID (e.g. Jdoe001)

CSV 2

  1. First_Name
  2. Last_Name
  3. Token_Nr

What I want to do is get combine CSV2 with CSV1 (easy) and then find the person's manager's full name with nothing more than the ManagerRACF field (unknown).

For the first part:

source=CSV1.csv
|join displayName[search index="main" source="CSV2.csv" | eval displayName=First_Name." ".Last_Name |dedup displayName| fields + displayName]
| table displayName, ManagerRACF, ManagerName, Token_Nr

This will join the two files and show the user's full name, the Manager's UserID and the user's Token number.

Now how do i get ManagerName to translate into the full name of the person's manager from CSV 1 based on the data in the ManagerRACF column? Basically what this means is, I need to find data in ManagerRACF (Jdoe002) search the sAMAccountName column for that value, and then return the results from displayName on that row into the ManagerName column.

Thanks!

Ken


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>