topic Re: Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222396#M1386 <P>the search was missing `` around drop_dm_object_name("All_Identities")</P> <P>Corrected and run it but it does not populate first and last name. </P> Tue, 29 Sep 2020 11:42:38 GMT ttchorz 2020-09-29T11:42:38Z Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222394#M1384 <P>I have a lookup with 461 usernames. I want to input the lookup to Splunk and display corresponding First and Last name from Splunk Enterprise Security Identities. </P> <P>Any ideas how to construct that search? </P> <PRE><CODE>|inputlookup users | `identities` user xxxx yyyy zzzz ... </CODE></PRE> Mon, 07 Nov 2016 20:02:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222394#M1384 ttchorz 2016-11-07T20:02:56Z Re: Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222395#M1385 <P>Try this one.</P> <P>|inputlookup users.csv|fields user|eval user=lower(user)|join type=left user [<CODE>datamodel("Identity_Management", "All_Identities")</CODE>| <CODE>drop_dm_object_name("All_Identities")</CODE>|mvexpand identity|rename identity as user|eval user=lower(user)]|table user first last</P> Mon, 07 Nov 2016 20:54:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222395#M1385 kiran331 2016-11-07T20:54:55Z Re: Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222396#M1386 <P>the search was missing `` around drop_dm_object_name("All_Identities")</P> <P>Corrected and run it but it does not populate first and last name. </P> Tue, 29 Sep 2020 11:42:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222396#M1386 ttchorz 2020-09-29T11:42:38Z Re: Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222397#M1387 <P>try updated one.. </P> Mon, 07 Nov 2016 21:04:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222397#M1387 kiran331 2016-11-07T21:04:54Z Re: Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222398#M1388 <P>Kiran, </P> <P>Apologies, I did not noticed the updated search. <BR /> It was great, producing expected results !</P> <P>Thanks!</P> Mon, 07 Nov 2016 21:13:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-construct-an-inputlookup/m-p/222398#M1388 ttchorz 2016-11-07T21:13:30Z