topic Re: How do I compare lookup field to search and print another field in lookup file? in Splunk Search

How do I compare lookup field to search and print another field in lookup file?

cyrus_thesplunk — Tue, 04 Apr 2023 16:33:43 GMT

Currently in my logs I am getting the hostname of the users but not their usernames. I created a lookup table that contains hostnames and usernames. I am trying to match the hostname from search to the hostname in the lookup file and then print their correlated username in a table format in the search visualization.

Lookup file:

hostname	username
host1	user1
host2	user2
host3	user3
host4	user4

search:
index=windows sourcetype:eventlogs
[|inputlookup users.csv | fields hostname username | rename hostname as users]
~~~print username correlated to "users" in the above string.~~~

Re: How do I compare lookup field to search and print another field in lookup file?

somesoni2 — Tue, 04 Apr 2023 18:39:51 GMT

You would need to use "lookup" command to enrich your data from lookup table fields, like this

index=windows sourcetype:eventlogs | lookup users.csv hostname as host OUTPUT username as users

Re: How do I compare lookup field to search and print another field in lookup file?

cyrus_thesplunk — Wed, 05 Apr 2023 11:03:09 GMT

Got it. I understand this part but where are you comparing the hostname in the search to hostname in the lookup file and then printing the username correlated to that hostname in the table.

This is what the search visualization results should look like.

Time	Hostname	Username	Src IP
5:01 am	host1	user1	192.xxx.xxx.xxx
5:07 am	host2	user2	192.xxx.xxx.xxx
5:09 am	host3	user3	192.xxx.xxx.xxx

Username information is the only thing thats coming from the lookup file. Rest of it comes from the search.

Re: How do I compare lookup field to search and print another field in lookup file?

woodcock — Thu, 06 Apr 2023 00:24:54 GMT

index="windows" AND sourcetype="eventlogs"
| lookup users.csv hostname AS host OUTPUT username AS users
| table _time Time Hostname Username Src IP

Re: How do I compare lookup field to search and print another field in lookup file?

cyrus_thesplunk — Thu, 06 Apr 2023 13:17:33 GMT

Thank you! This worked perfectly