topic Re: Enrich Data with Lookup File in Getting Data In

Enrich Data with Lookup File

stevenbutterwor — Tue, 29 Sep 2020 16:56:13 GMT

Hi all

I'm trying to enrich sone data with a csv lookup file. I've created the csv and defined the lookup but I can't get it to output for some reason. What am I doing wrong? Search below:

eventtype="domainsecuritylog" EventCode=4624 | top user,Logon_Type showperc=false | lookup logontype Logon_Code OUTPUT Logon_Code, Logon_Description

As you can see I'm searching for a windows event code which contains a Logon_type number. I'm then trying to match the number to the description in the lookup file.

Any help would be much appreciated!

Re: Enrich Data with Lookup File

gcusello — Thu, 23 Nov 2017 15:28:09 GMT

Hi stevenbutterworth,
you have to put much attention on three points:

key field name must be the same both in search and lookup, and field name is case sensitive.
when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
then check if there are spaces in the lookup key field.

Bye.
Giuseppe

Re: Enrich Data with Lookup File

stevenbutterwor — Thu, 23 Nov 2017 15:53:29 GMT

Thanks cusello

It was your first point that was the issue. I had to RENAME a field so it matched the lookup file.

Thanks

Steve

Re: Enrich Data with Lookup File

niketn — Thu, 23 Nov 2017 16:00:05 GMT

@stevenbutterworth, if @cusello's answer resolved your issue, please accept the same to mark this question as answered.