Hi Everyone,
I have run into a problem I am not able to easily solve with Splunk. I have splunk query that returns some data, user name, appname, and app time accessed. This returns results for all users.
I separately have a list of users. I am trying to find the fields listed above for the list of users. I have uploaded the list of users both as file and lookup. I am not able to get the search to only return the list of users. search info below. Thanks!
index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])"
AND
|inputlookup UserList.csv | rename "Garbage Name" as userName
I can not figure out how to get these two searches to merged. Any help would be great thanks!
index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])" | fields appname, userName, date | join userName[|inputlookup UserList.csv | rename "Garbage Name" as userName]
Seem to do it thanks!
This is actually pretty easy using subsearches provided you are within limits as listed on that page.
index=prod_index sourcetype=MySource
| rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])"
| where [inputlookup UserList.csv | rename "Garbage Name" as userName | fields userName]
The results of the subsearch gets expanded into a search expression ((userName="foo") OR (userName="bar") ... ) and put into the parent search.
Additionally, if you're able to build a field extractions in MySource and get rid of the rex command you can even simplify this further to a single search expression:
index=prod_index sourcetype=MySource [inputlookup UserList.csv | rename "Garbage Name" as userName | fields userName]
index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])" | fields appname, userName, date | join userName[|inputlookup UserList.csv | rename "Garbage Name" as userName]
Seem to do it thanks!