topic Re: Limit Results with CSV in Getting Data In

Limit Results with CSV

nspatel — Mon, 28 Sep 2020 19:56:36 GMT

Hi Everyone,

I have run into a problem I am not able to easily solve with Splunk. I have splunk query that returns some data, user name, appname, and app time accessed. This returns results for all users.

I separately have a list of users. I am trying to find the fields listed above for the list of users. I have uploaded the list of users both as file and lookup. I am not able to get the search to only return the list of users. search info below. Thanks!

index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])"
AND
|inputlookup UserList.csv | rename "Garbage Name" as userName

I can not figure out how to get these two searches to merged. Any help would be great thanks!

Re: Limit Results with CSV

nspatel — Mon, 28 Sep 2020 19:56:38 GMT

Seem to do it thanks!

Re: Limit Results with CSV

acharlieh — Mon, 11 May 2015 16:02:31 GMT

This is actually pretty easy using subsearches provided you are within limits as listed on that page.

index=prod_index sourcetype=MySource 
| rex field=_raw "&lt;&lt;LOT OF COMPLEX REGEX&gt;&gt;(?&lt;appname&gt;[^]]) (?&lt;userName&gt;[^]])"
| where [inputlookup UserList.csv | rename "Garbage Name" as userName | fields userName]

The results of the subsearch gets expanded into a search expression ((userName="foo") OR (userName="bar") ... ) and put into the parent search.

Additionally, if you're able to build a field extractions in MySource and get rid of the rex command you can even simplify this further to a single search expression:

index=prod_index sourcetype=MySource [inputlookup UserList.csv | rename "Garbage Name" as userName | fields userName]