Getting Data In

Enrich Data with Lookup File

stevenbutterwor
Path Finder

Hi all

I'm trying to enrich sone data with a csv lookup file. I've created the csv and defined the lookup but I can't get it to output for some reason. What am I doing wrong? Search below:

eventtype="domainsecuritylog" EventCode=4624 | top user,Logon_Type showperc=false | lookup logontype Logon_Code OUTPUT Logon_Code, Logon_Description

As you can see I'm searching for a windows event code which contains a Logon_type number. I'm then trying to match the number to the description in the lookup file.

Any help would be much appreciated!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi stevenbutterworth,
you have to put much attention on three points:

  • key field name must be the same both in search and lookup, and field name is case sensitive.
  • when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
  • then check if there are spaces in the lookup key field.

Bye.
Giuseppe

View solution in original post

stevenbutterwor
Path Finder

Thanks cusello

It was your first point that was the issue. I had to RENAME a field so it matched the lookup file.

Thanks

Steve

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi stevenbutterworth,
you have to put much attention on three points:

  • key field name must be the same both in search and lookup, and field name is case sensitive.
  • when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
  • then check if there are spaces in the lookup key field.

Bye.
Giuseppe

niketn
Legend

@stevenbutterworth, if @cusello's answer resolved your issue, please accept the same to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...