topic Re: Query returns zero events in Splunk Search

Query returns zero events

anikeshp7 — Sun, 13 Sep 2020 16:58:27 GMT

Any suggestions how the query can be improved

This returns no events as of now.

In the lookup csv Im having UserId and Name as two columns.

index=123 AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

Re: Query returns zero events

thambisetty — Sun, 13 Sep 2020 17:27:19 GMT

What would you like to do with lookup command here?

Lookups are used to enrich event information.

you are matching userid from events and lookup and again you are trying get userid from lookup. Were you trying to get name for userId?

have a look at below video.

https://youtu.be/E3-JaZEIXPw

Re: Query returns zero events

anikeshp7 — Mon, 14 Sep 2020 08:13:21 GMT

Yes @thambisetty . Trying to display names with session_key and time

Re: Query returns zero events

thambisetty — Mon, 14 Sep 2020 08:57:36 GMT

index=123 organizationId=00TY00000005677 logRecordType=ailtn (Lightning_Console) | stats earliest(_time) as session_start latest(_time) as session_end by sessionKey,userId | lookup test123.csv UserId AS userId OUTPUT Name | convert ctime(*time) timeformat="%d/%m/%Y %T"