topic Re: Eval against a lookup in Splunk Search

Eval against a lookup

Tika — Sun, 13 Feb 2022 22:54:34 GMT

Hello, I am new to Splunk and this is probably a basic query. I have a field with an email address and I want to check if the email exists in a look up table and eval it to 1, if found and 0 if not.

I also have multiple emails in the field and this is what I have come up with so far, any help is much appreciated.

But this gives me counts and Im not sure if the result is accurate either. Thanks!

Re: Eval against a lookup

yuanliu — Mon, 14 Feb 2022 03:39:43 GMT

There is only one step from your lookup output to 0-or-1 determination: if(X,Y,Z).

Re: Eval against a lookup

yuanliu — Mon, 14 Feb 2022 03:43:16 GMT

(Clicked Enter by mistake and for some reason I cannot edit or delete the above. So here goes)

| eval in_lookup = if(isnull(user), 0, 1)

Re: Eval against a lookup

Tika — Mon, 14 Feb 2022 03:44:11 GMT

Thanks! that works

Re: Eval against a lookup

gcusello — Mon, 14 Feb 2022 07:36:30 GMT

Hi @Tika,

you could run something like this:

Ciao.

Giuseppe