topic Re: help on a field rename in a subsearch in Splunk Search

help on a field rename in a subsearch

jip31 — Fri, 05 Jul 2019 08:52:05 GMT

I use the subsearch below in order to match host in host.csv with host in the index
But in the index, the host field is called USERNAME
So I am doing a rename in my subsearch but I am unable to match with the index events
what is the problem please??

[| inputlookup host.csv 
    | table host| rename host as USERNAME ] index=A sourcetype=wireless USERNAME=TOTA

Re: help on a field rename in a subsearch

chrispounds — Fri, 05 Jul 2019 10:30:02 GMT

I think you need to place the search before the lookup, so it would look something like this

index-A sourcetype=wireless USERNAME=TOTA [inputlookup host.csv | table host | rename host as USERNAME]

See if that works perhaps?

Re: help on a field rename in a subsearch

DavidHourani — Fri, 05 Jul 2019 10:36:10 GMT

Hi @jip31,

Maybe USERNAME=TOTA is causing the problem as it only filters on TOTA. Try it as follows :

index=A sourcetype=wireless   [| inputlookup host.csv | table host| rename host as USERNAME ]

If you want to enrich your data with the lookup then this should do :

index=A sourcetype=wireless  | lookup host.csv host AS USERNAME

Best regards,
David

Re: help on a field rename in a subsearch

jip31 — Fri, 05 Jul 2019 12:05:28 GMT

its not working...

Re: help on a field rename in a subsearch

jip31 — Fri, 05 Jul 2019 12:13:02 GMT

thanks to you