Getting Data In

Inputlookup usage

Mohsin123
Path Finder

I have an inputlookup table with list of email addresses . I already have a pre existing field called user . How do I use this inputlookup with only those values which are present in my lookup table and the user field

below is my search query :

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user

I am using this query for the purpose of finding the searches made by the users .
And I have a lookup table , UserEmail with list of users who no longer exist but have scheduled searches still running . These user name are in user field also . I have to use my lookup table user values to result in my query

Thanks

Tags (1)
0 Karma

DalJeanis
Legend

There are two different commands here. You want lookup, not inputlookup.

inputlookup is a generating command that adds all the records from the lookup file into the search.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/inputLookup

lookup is a "join-type" command that uses data from the existing event as a key to look up additional data from the lookup table, and add it to the existing event if found.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Lookup

0 Karma

DEAD_BEEF
Builder

Assuming the following:

  1. lookuptable is named lookuptable.csv when uploaded to splunk in the Destination filename box
  2. column header (cell A1) is called user
  3. field in your logs is called user
  4. entries in lookuptable match EXACTLY to what is in your logs

.

| inputlookup lookuptable.csv | fields user 
| stats count by user search _time
0 Karma

DalJeanis
Legend

@DEAD_BEEF - I like your style of stating your assumptions. Great practice. You are missing an open brace [, please update.

You could also optionally adjust your code to assume the output from his current search, which could come in the top of your code as if the last command had been...

| table user time search

... so you'd change your first line to (before the subsearch) have a where clause or a search clause on the prior results.

somesoni2
Revered Legend

Does your lookup table has exact user name values which matches values of field "user" from above search?

0 Karma

Mohsin123
Path Finder

yes exact

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...