topic Re: How to partially join two lookups in Splunk Search

How to partially join two lookups?

olegr — Wed, 23 Mar 2022 04:19:51 GMT

Hello,

Looking for a way to partially join 2 inputlookups.

Lookup 1: username, name

jsmith, John
jdoe, Joe

Lookup 2:username,status

jsmith-sa, enabled

I would like to return a match on jsmith to jsmith-sa but have not been able to figure out how to partially join. ie search for jsmith* against lookup2 not for exact matches. The 2nd lookup may have the entire keyword or keyword-something Search returns:

jsmith,jsmith-sa,enabled

Re: How to partially join two lookups

somesoni2 — Tue, 22 Mar 2022 16:32:57 GMT

Best way would be to setup a wildcard match lookup definition as described in this post (you'll have to modify lookup content which contains partial value i.e. Lookup1 to include wildcard).

https://community.splunk.com/t5/Splunk-Search/Wildcards-in-lookup-file/m-p/292586

Re: How to partially join two lookups

olegr — Tue, 22 Mar 2022 18:34:55 GMT

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv | rex field=User "^(?<UserShort>.+?)\-suffix" | eval identity = if(isnull(UserShort), User, UserShort) | join identity [inputlookup lookup2] ...