https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341410#M163208 <P>You don't need a script for this. Take a look at <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Aboutlookupsandfieldactions">lookups</A> . Write a lookup that has a uid &gt; username correlation and you can <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/DefineanautomaticlookupinSplunkWeb">run it automatically</A> if needed.</P> Wed, 31 Jan 2018 23:41:08 GMT davpx 2018-01-31T23:41:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341409#M163207 <P>Hello,</P> <P>I want to know if it is possible to do a script which read a file and correlate the data in this file with an event in Splunk.</P> <P>For example, when I put a USB key in Linux, I have this log:</P> <P><CODE>Jan 31 11:02:51 PFSplunkCentOS5 hald: mounted /dev/sdb1 on behalf of uid 0</CODE></P> <P>and I want to correlate UID 0 with the <CODE>file /etc/passwd</CODE> and say <CODE>uid 0 = root</CODE> or other user and put root in the event in Splunk like metadata.</P> <P>Cordially</P> <P>amir</P> Wed, 31 Jan 2018 16:44:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341409#M163207 amir_thales 2018-01-31T16:44:45Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341410#M163208 <P>You don't need a script for this. Take a look at <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Aboutlookupsandfieldactions">lookups</A> . Write a lookup that has a uid &gt; username correlation and you can <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/DefineanautomaticlookupinSplunkWeb">run it automatically</A> if needed.</P> Wed, 31 Jan 2018 23:41:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341410#M163208 davpx 2018-01-31T23:41:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341411#M163209 <P>Hello davpx,</P> <P>How can read the /etc/passwd file to correlate the uid with the user because the "lookup" function uses only KML, KMZ and CSV and I want to use the "/etc/passwd" which isn't a KML, KMZ or CSV file.</P> <P>Thank you <BR /> amir</P> Mon, 05 Feb 2018 09:49:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341411#M163209 amir_thales 2018-02-05T09:49:33Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341412#M163210 <P>my problem is solved thank you</P> Mon, 05 Feb 2018 15:23:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-script-to-correlate-data-in-a-file-with-an-event/m-p/341412#M163210 amir_thales 2018-02-05T15:23:15Z