topic Re: Inputlookup usage in Getting Data In

Inputlookup usage

Mohsin123 — Tue, 29 Sep 2020 17:14:02 GMT

I have an inputlookup table with list of email addresses . I already have a pre existing field called user . How do I use this inputlookup with only those values which are present in my lookup table and the user field

below is my search query :

I am using this query for the purpose of finding the searches made by the users .
And I have a lookup table , UserEmail with list of users who no longer exist but have scheduled searches still running . These user name are in user field also . I have to use my lookup table user values to result in my query

Thanks

Re: Inputlookup usage

somesoni2 — Wed, 13 Dec 2017 16:22:14 GMT

Does your lookup table has exact user name values which matches values of field "user" from above search?

Re: Inputlookup usage

DEAD_BEEF — Wed, 13 Dec 2017 16:32:18 GMT

Assuming the following:

lookuptable is named lookuptable.csv when uploaded to splunk in the Destination filename box
column header (cell A1) is called user
field in your logs is called user
entries in lookuptable match EXACTLY to what is in your logs

| inputlookup lookuptable.csv | fields user 
| stats count by user search _time

Re: Inputlookup usage

DalJeanis — Wed, 13 Dec 2017 16:35:50 GMT

There are two different commands here. You want lookup, not inputlookup.

inputlookup is a generating command that adds all the records from the lookup file into the search.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/inputLookup

lookup is a "join-type" command that uses data from the existing event as a key to look up additional data from the lookup table, and add it to the existing event if found.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Lookup

Re: Inputlookup usage

DalJeanis — Wed, 13 Dec 2017 16:42:04 GMT

@DEAD_BEEF - I like your style of stating your assumptions. Great practice. You are missing an open brace [, please update.

You could also optionally adjust your code to assume the output from his current search, which could come in the top of your code as if the last command had been...

| table user time search

... so you'd change your first line to (before the subsearch) have a where clause or a search clause on the prior results.

Re: Inputlookup usage

Mohsin123 — Mon, 18 Dec 2017 08:45:33 GMT

yes exact