topic Re: Need to compare the contents of a lookup file with search results in Splunk Search

Need to compare the contents of a lookup file with search results

jcaron9999a — Thu, 27 May 2021 23:42:56 GMT

Hi,

Brand new to splunk here. I've been using it about 1 month. I have a lookup file, all_identities_prod.csv, that has a single column of identities (these look like email addresses) and the column name is 'identity'. What I've been trying to do is to compare the identities in the file with the result of a 30 day search to find identities that are in the lookup file but not in the search results. I've tried this many different ways. Maybe using a lookup file for this isn't the best idea. I don't know. Here's an example of what I've been trying. A subsearch seemed like the best idea.

| inputlookup all_identities_prod.csv where NOT [search index=sec ab_id=cvo host=xxx-xxxx* identity="*" | dedup identity] | table identity

I have to obfuscate the host name understandably. What I get back from this is the full list of the identities in the lookup file. I think the comparison function is where I'm lost. Any ideas? Maybe a better way of doing this altogether?

Thanks in advance.

Re: Need to compare the contents of a lookup file with search results

richgalloway — Fri, 28 May 2021 00:09:27 GMT

Try adding the format command to the subsearch.

| inputlookup all_identities_prod.csv where NOT [search index=sec ab_id=cvo host=xxx-xxxx* identity="*" | dedup identity | format] | table identity

Re: Need to compare the contents of a lookup file with search results

gcusello — Fri, 28 May 2021 06:14:14 GMT

Hi @jcaron9999a,

let me understand: you want to know the identities from your lookup not present in the search results, is it correct?

If this is your need, please try this:

Ciao.

Giuseppe

Re: Need to compare the contents of a lookup file with search results

jcaron9999a — Fri, 28 May 2021 22:44:01 GMT

Thanks Giuseppe. Works perfectly.

Re: Need to compare the contents of a lookup file with search results

gcusello — Sat, 29 May 2021 05:19:21 GMT

Hi @jcaron9999a,

good for you, see next time!

Please accept the answer or the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉