topic How do I edit my search on usernames to also table associated passwords? in Splunk Search

How do I edit my search on usernames to also table associated passwords?

mohanmk1905 — Tue, 15 Nov 2016 13:24:10 GMT

I am getting Username and User id Fields while search using username, then I pipe it and search user ID to get the password. How to put them in a table TABLE USERNAME USERID PASSWORD like this.

index!=_internal "USERNAME" | TABLE USERNAME USERID | SEARCH index!=_internal "$USERID$" | TABLE USERNAME USERID PASSWORD

The search above is not working.

Re: How do I edit my search on usernames to also table associated passwords?

gcusello — Tue, 15 Nov 2016 14:40:31 GMT

Hi mohanmk1905,
After a table command, the only fields you have are the ones you listed in table: in your example you haven't PASSWORD field in the first table, so, in the following pipes you haven't PASSWORD field, but only USERNAME and USERID.

Every way it's strange the way you have to build your search:

why do you use index!=_internal? if you use index=* you have the same result!
if you can, try to express indexes in your search (index=main OR index=web...): it's more efficient;
why do you use fields search in two points? it's more efficient to have only one search as first as possible;
I think that "USERNAME" is a word and not a field, if it's a field you have to insert in your search USERNAME="$USERNAME$" or a value.

Probably your search is better like something:

index=* "USERNAME" "$USERID$" | TABLE USERNAME USERID PASSWORD

Bye.
Giuseppe

Re: How do I edit my search on usernames to also table associated passwords?

inventsekar — Tue, 15 Nov 2016 14:54:15 GMT

Hi mohanmk,
Please check this one -

index!=_internal "USERNAME" OR "$USERID$" | TABLE USERNAME USERID PASSWORD

Re: How do I edit my search on usernames to also table associated passwords?

mohanmk1905 — Wed, 16 Nov 2016 07:37:39 GMT

Sorry i didn't convey my question correctly.- This is not an exact scenario but i am trying to make a similar scenario.

Let me explain it clearly.

After First search - i am able to take USERNAME AND USERID in a table.

First search : index = something "USERNAME" | table USERNAME USERID

Second search - i am searching all the USERID feilds taken in first search and taking password in the second search for that userid . so i am take USERID and PASSWORD table here.

index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD

i am able to join two searches using join

But i feel like i am using the same search (index = something "USERNAME" ) twice in the join scenario.
Please how to get that three feild in one search itself

Re: How do I edit my search on usernames to also table associated passwords?

mohanmk1905 — Wed, 16 Nov 2016 07:39:02 GMT

sorry sir i conveyed my question correctly now

Re: How do I edit my search on usernames to also table associated passwords?

gcusello — Wed, 16 Nov 2016 07:59:29 GMT

Hi mohanmk1905,
every way the problem is the same: if you haven't password field in the first table command, you haven't it in the second one, try the search I suggested: the output of a command on the left of the pipe "|" is the input for the command on the right of the pipe "|".
bye.
Giuseppe