Getting Data In

Enrich Data with Lookup File

Path Finder

Hi all

I'm trying to enrich sone data with a csv lookup file. I've created the csv and defined the lookup but I can't get it to output for some reason. What am I doing wrong? Search below:

eventtype="domainsecuritylog" EventCode=4624 | top user,LogonType showperc=false | lookup logontype LogonCode OUTPUT LogonCode, LogonDescription

As you can see I'm searching for a windows event code which contains a Logon_type number. I'm then trying to match the number to the description in the lookup file.

Any help would be much appreciated!

0 Karma
1 Solution

Legend

Hi stevenbutterworth,
you have to put much attention on three points:

  • key field name must be the same both in search and lookup, and field name is case sensitive.
  • when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
  • then check if there are spaces in the lookup key field.

Bye.
Giuseppe

View solution in original post

Path Finder

Thanks cusello

It was your first point that was the issue. I had to RENAME a field so it matched the lookup file.

Thanks

Steve

0 Karma

Legend

Hi stevenbutterworth,
you have to put much attention on three points:

  • key field name must be the same both in search and lookup, and field name is case sensitive.
  • when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
  • then check if there are spaces in the lookup key field.

Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

@stevenbutterworth, if @cusello's answer resolved your issue, please accept the same to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma