topic Re: data and lookup field problem in Splunk Search

data and lookup field problem

secure — Tue, 17 Dec 2024 19:44:01 GMT

Hi All

i have a csv look up with below data

Event_Code

AUB01

AUB36

BUA12

i want to match it with a dataset which has field name Event_Code with several values i need to extract the count of the event code per day from the matching csv lookup

my query

however the result is showing all 100 count per day instaed of matching the event code from the CSV and then give the total count per day

Re: data and lookup field problem

gcusello — Tue, 17 Dec 2024 15:31:55 GMT

Hi @secure ,

if you want to filter results from main search using the Event_Codes from the lookup, you must use a subsearch:

If you extract the Event_Code field before the search as a field, you can put the subsearch in the main search.

Ciao.

Giuseppe

Re: data and lookup field problem

richgalloway — Tue, 17 Dec 2024 15:36:33 GMT

The query checks the lookup file, but then does nothing with it. That's why all events are counted. Try this

If the Event_Code field did not need to be extracted via rex then we could have used inputlookup to give Splunk a list of codes to search for.