topic Re: Lookup matching field and bring in new field from lookup in Splunk Search

Lookup matching field and bring in new field from lookup

rpatelnes — Tue, 15 Jan 2019 21:37:22 GMT

Hello, I've been banging my head against the wall over the last like two hours over this and figured I should just post since I don't find Splunk documentation that helpful, detailed, or plentiful.

Objective: What I want to do is we have the results from a nice search query. Now we want to take the full hostname and compare that to a field in the Lookup and from there bringing in an related alternate field from that lookup.

The example hopefully is easy to understand and something quick I'm just screwing up.

So our query below is returning us the following:

What I want to accomplish is use the CSV lookup file I have, use the clienthost field and compare that against the DNS field in my lookup file. And from there automatically pull in the matching related value from Description. Does that make sense hopefully. I tried every variation of using | | lookup ComputerNameDescription.csv DNS as clienthost OUTPUT Description, etc. Idk. I tried like 20 different ways and it's not looking it up, matching and letting me bring in the matching Description.

Can someone please tell me what we're doing wrong.

Thanks

Re: Lookup matching field and bring in new field from lookup

kamlesh_vaghela — Wed, 16 Jan 2019 11:43:06 GMT

@rpatelnes

Have you tried OUTPUTNEW option of lookup command ?

Can you please confirm DescriptionNew returning anything using below lookup command?

| lookup ComputerNameDescription.csv DNS as clienthost OUTPUTNEW Description as DescriptionNew

Ref:
https://docs.splunk.com/Documentation/SplunkCloud/7.1.3/SearchReference/Lookup

Re: Lookup matching field and bring in new field from lookup

jkat54 — Wed, 16 Jan 2019 15:15:23 GMT

I don’t see the ip fields in your lookup.

So there’s nothing to match/join it to.

Re: Lookup matching field and bring in new field from lookup

rpatelnes — Wed, 16 Jan 2019 15:20:01 GMT

@kamlesh_vaghela

I have tried that as one of the variations when I was going through the documentation, but it still doesn't work. See my image below:

@jkat54

Yes there is a match. I'm matching the DNS field in the CSV to my clienthost field in my events which should align. See images.

Any further ideas?

Re: Lookup matching field and bring in new field from lookup

jkat54 — Wed, 16 Jan 2019 20:09:06 GMT

Not in your search sample you gave.

You need to give lookup command more details.

See the lookup command documentation Kamlesh provided.

Re: Lookup matching field and bring in new field from lookup

jkat54 — Wed, 16 Jan 2019 20:11:12 GMT

Try swapping clienthost and DNS around

Re: Lookup matching field and bring in new field from lookup

rpatelnes — Wed, 23 Jan 2019 21:13:59 GMT

No real answer yet, all suggestions have failed so far.