How to check value of my search present in which lookup table

akshayinnamuri — Thu, 06 Oct 2022 06:31:02 GMT

Hi

I am looking for query where say for example user=xyz which is present in multiple watchlists [watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv] and not present in watchlist_E.csv, watchlist_F.csv

watchlist have columns
[ number, user, date ]

1, xyz, 01022000

2, abc, 02022000

I am looking for query to use multiple watchlist and find value of my search say user=abc when queried should show a table as below

user, watchlistNames

If result is present in multiple table it should give me the watclistnames

where my search is user=abc and is present in watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv

so my query result should be

user, Watchlistnames

abc,watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv

Re: How to check value of my search present in which lookup table

gcusello — Thu, 06 Oct 2022 06:45:36 GMT

Hi @akshayinnamuri,

please try something like this:

<your_search> | lookup watchlist_A.csv user OUTPUT number AS number_watchlist_A.csv | lookup watchlist_B.csv user OUTPUT number AS number_watchlist_B.csv | lookup watchlist_C.csv user OUTPUT number AS number_watchlist_C.csv | lookup watchlist_D.csv user OUTPUT number AS number_watchlist_D.csv | table user number_watchlist_A.csv number_watchlist_B.csv number_watchlist_C.csv number_watchlist_D.csv

Then, if you likem you can also put a status message (using eval) to indicate if some lookup is missing.

Ciao.

giuseppe

topic Re: How to check value of my search present in which lookup table in Splunk Search

How to check value of my search present in which lookup table

Re: How to check value of my search present in which lookup table