topic Yes / No Column if EventCode Found in Lookup in Splunk Search

Yes / No Column if EventCode Found in Lookup

aferone — Thu, 05 Nov 2020 17:31:09 GMT

I have a lookup table with certain Windows Event Codes. I am searching our Windows index for all Windows Event Codes. I would like a count of all Windows Event Codes, per Event Code, and a column that says whether that Event Code is in my lookup table. This is what I am attempting partly with what I found on Answers, but it isn't working:

Thank you in advance!

Re: Yes / No Column if EventCode Found in Lookup

richgalloway — Thu, 05 Nov 2020 18:46:01 GMT

Try this query.

Re: Yes / No Column if EventCode Found in Lookup

aferone — Thu, 05 Nov 2020 21:14:36 GMT

Thanks!