topic Re: Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events in Splunk Search

Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

roderick001 — Fri, 27 Nov 2020 18:11:04 GMT

My search is | inputlookup "edgarlog2.csv"

The lookup file has no events attached to it, what is a way to add events from a lookup file whilst viewing it in the main search and reporting app?

Any help would be great, thanks.

Re: Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

to4kawa — Fri, 27 Nov 2020 23:40:42 GMT

What is the content of CSV?

Re: Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

roderick001 — Mon, 30 Nov 2020 13:09:18 GMT

Hi @to4kawa sorry for late reply, the csv file has 15 fields with client ip and date and file references, I can't load it from add data and can only add as lookup, but lookup does not allow me to view it as timestamped events.

Why can I not load it as add data?

Why can I not view events from lookup?

Thanks a lot for any help.

Re: Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

to4kawa — Tue, 01 Dec 2020 12:20:07 GMT

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Inputcsv

please check permission.

https://community.splunk.com/t5/Security/How-to-change-permission/m-p/403043

Re: Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

roderick001 — Tue, 01 Dec 2020 13:35:58 GMT

Thnaks a lot @to4kawa , I will look into it and get back to you.