topic Re: Noob:Inputlookup match Security ID fileds in Getting Data In

Noob:Inputlookup match Security ID fileds

je13aier74 — Tue, 29 Sep 2020 23:58:11 GMT

Trying to use a CSV for inputlookup the username field should be Security_ID and there is only one column with the Security_ID in the CSV.

I just want my search results to show events that have the Security_IDs that are in the CSV. I'm a total noob so I'm very confused. Any assist would be greatly appreciated. I know this doesn't work below, but don't know why 🙂

| inputlookup departmentusers.csv
| fields Security_ID
| index="wineventlog" EventCode="4740" host="MyPDC"

Re: Noob:Inputlookup match Security ID fileds

starcher — Fri, 05 Apr 2019 17:38:35 GMT

Search then apply a lookup

index="wineventlog" EventCode="4740" host="MyPDC" | lookup departmentusers.csv Security_ID OUTPUTNEW

Re: Noob:Inputlookup match Security ID fileds

somesoni2 — Fri, 05 Apr 2019 17:46:15 GMT

Try like this

index="wineventlog" EventCode="4740" host="MyPDC" [| inputlookup departmentusers.csv | fields Security_ID]

Re: Noob:Inputlookup match Security ID fileds

je13aier74 — Fri, 05 Apr 2019 17:47:21 GMT

This failed to work for me. States "Error in 'lookup' command: Could not construct lookup 'departmentusers.csv, Security_ID, OUTPUTNEW'. See search.log for more details."

Everything I've seen shows that the InputLookup has to be first so it's confusing to say the least.