https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275088#M190279 <P>The other search should that should be setup to run every 24 hours just after the other file is written is this:</P> <PRE><CODE>your base search on daily data | dedup user_id computer_id | table user_id computer_id | outputcsv usermapping.csv </CODE></PRE> Sat, 28 May 2016 21:21:41 GMT woodcock 2016-05-28T21:21:41Z https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275086#M190277 <P>I'm looking to find a way to match up info from one data source that only changes once per day, and another data source that changes frequently. Each night we map <CODE>user_id</CODE> to <CODE>computer_id</CODE> and that file gets ingested into Splunk. During the day I have a constant stream of data coming in with mappings of <CODE>action_taken</CODE> and <CODE>computer_id</CODE>. </P> <P>My challenge is that I need to be able to look up the mapping of <CODE>user_id</CODE> to <CODE>action_taken</CODE> historically, to within the minute, and through the API. </P> <P>What is the best way to search/lookup/report that mapping? </P> <P>Thanks!</P> Sat, 28 May 2016 03:55:01 GMT https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275086#M190277 tboyden 2016-05-28T03:55:01Z https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275087#M190278 <P>I think you should use an lookup table and maybe even setup automatic lookup. In a nutshell, the process you have running once a day, generates a .csv file. Setup this .csv as a lookup and have the daily process update the same file. You can also do an automatic lookup which will automatically, include the user_id on every search. Here's what your search will look like. Assume your lookup file is called usermapping.csv</P> <PRE><CODE>your base search on streaming data | lookup usermapping.csv computer_id OUTPUT user_id | .... </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.5/Knowledge/Usefieldlookupstoaddinformationtoyourevents">http://docs.splunk.com/Documentation/Splunk/6.0.5/Knowledge/Usefieldlookupstoaddinformationtoyourevents</A></P> Sat, 28 May 2016 18:23:03 GMT https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275087#M190278 sundareshr 2016-05-28T18:23:03Z https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275088#M190279 <P>The other search should that should be setup to run every 24 hours just after the other file is written is this:</P> <PRE><CODE>your base search on daily data | dedup user_id computer_id | table user_id computer_id | outputcsv usermapping.csv </CODE></PRE> Sat, 28 May 2016 21:21:41 GMT https://community.splunk.com/t5/Splunk-Search/Find-correlation-between-nearly-static-data-and-a-data-feed/m-p/275088#M190279 woodcock 2016-05-28T21:21:41Z