topic Re: search with lookup in Splunk Search

search with lookup

corehan — Sun, 03 Oct 2021 19:54:38 GMT

Hello dears,

I have switches, ip address,ports and i want list with users which are connected to the ports. Users informations include lookup file which name is list.csv, so;

list.csv contains : ip,port,user

<base_search> | lookup list.csv ip as host AND port as if_name OUTPUT user |stats count by host,if_name,user

Re: search with lookup

richgalloway — Mon, 04 Oct 2021 00:25:35 GMT

What is your question?

BTW, the lookup command does not recognize AND as a keyword.

Re: search with lookup

corehan — Mon, 04 Oct 2021 05:04:50 GMT

Exactly, so highleted with red. if match host and if_name with lookup file, then list user info.

Regards.

Re: search with lookup

richgalloway — Mon, 04 Oct 2021 12:14:08 GMT

Again I ask: What is your question?

So you know enough to highlight the syntax error in red, but not enough to look up the syntax and fix it?

Please describe the problem you are trying to solve.

Re: search with lookup

corehan — Mon, 04 Oct 2021 13:31:38 GMT

Sorry, i can't list with user info, i need lookup syntax which is check ip and port from lookup file. How can i do this with correct lookup syntax? I should check 2 multivalue field and than add to user info. I hope, understand.

<base_search> | lookup list.csv ip as host AND port as if_name OUTPUT user |stats count by host,if_name,user

Re: search with lookup

richgalloway — Mon, 04 Oct 2021 13:46:06 GMT

The syntax for the lookup command is in the Search Reference manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Lookup#Syntax

Did you try removing the AND keyword as I implied in my first reply?

I can't say I've tried it before, but I believe lookups do not work with multi-value fields. You'll have to use mvindex or another multi-value function to get a single-value field for the lookup.

Re: search with lookup

corehan — Mon, 04 Oct 2021 21:51:14 GMT

Hello,

Now, i have some changes but still i can't list with lookup file's value;

Stats without user field;

Stats with user field;

lookup csv file;

Re: search with lookup

richgalloway — Tue, 05 Oct 2021 12:19:01 GMT

It's impossible to say why the data is not matching the lookup without seeing the data. Please share some samples.

Also, the lookup command is specifying the 'user_info' field, which does not exist in the lookup file.