topic Re: help to write the request correctly in Splunk Search

help to write the request correctly

gitingua — Thu, 21 Oct 2021 18:33:43 GMT

Hello guys!!

help to write the request correctly. otherwise I don't understand how to do it right

file.csv

username	ip_address_old	id_old	desti
John	192.168.11.5	1234	abcd

index = IndexName

usernem	ip_address_new	id_new	desti
John	172.168.15.10	4321	bsir

Where id_old != id_new. output

usernem	ip_address_new	id_new	desti	id_old
John	172.168.15.10	4321	bsir	1234

Re: help to write the request correctly

nmohammed — Thu, 21 Oct 2021 20:47:03 GMT

@gitingua

can you share your search query that you're trying for this result ?

Re: help to write the request correctly

somesoni2 — Thu, 21 Oct 2021 21:01:20 GMT

Try something like this:

index=IndexName | table username ip_address_new id_new desti | lookup username file.csv OUTPUT id_old | where id_new!=id_old

Re: help to write the request correctly

gitingua — Fri, 22 Oct 2021 11:37:24 GMT

Error in 'lookup' command: Could not construct lookup 'username, file.csv, OUTPUT, id_old'.

Re: help to write the request correctly

somesoni2 — Fri, 22 Oct 2021 14:00:13 GMT

Could you provide the actual query you tried? You may have added commas instead of spaces in lookup command. See this for syntax and example of lookup command:

https://docs.splunk.com/Documentation/SCS/current/SearchReference/LookupCommandExamples

Re: help to write the request correctly

gitingua — Sun, 24 Oct 2021 14:52:02 GMT

index = index

| table username src_ip asn
| lookup username user.csv OUTPUT asn_old
| where asn != asn_old

Re: help to write the request correctly

gitingua — Sun, 24 Oct 2021 15:04:33 GMT

index=IndexName | table username ip_address_new id_new desti | lookup file.csv username OUTPUT id_old | where id_new!=id_old

Thanks !!