topic Re: Filter a search result with lookup values- What command is most appropriate for this? in Splunk Search

Filter a search result with lookup values- What command is most appropriate for this?

iammax — Mon, 05 Sep 2022 22:51:14 GMT

Hi,

I have a search query where a field is named "user_email".
I also have a lookup table where I have a list of emails.

Now I want my search query to only show results where "user_email" is present in the lookup table that I have.

What command is most appropriate for this?

Re: Filter a search result with lookup values- What command is most appropriate for this?

bowesmana — Mon, 05 Sep 2022 23:58:55 GMT

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search | lookup your_lookup.csv user_email OUTPUT user_email as found_email | where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

Re: Filter a search result with lookup values- What command is most appropriate for this?

richgalloway — Tue, 06 Sep 2022 00:13:37 GMT

If you're looking for something in a lookup table then the correct command to use is lookup. You look for the given value in the table and get some other field from the lookup table in response. If the response is not NULL then the value exists in the lookup.

| lookup mylookup.csv user_field OUTPUT foo | where isnotnull(foo)