Getting Data In

Limit Results with CSV

nspatel
Explorer

Hi Everyone,

I have run into a problem I am not able to easily solve with Splunk. I have splunk query that returns some data, user name, appname, and app time accessed. This returns results for all users.

I separately have a list of users. I am trying to find the fields listed above for the list of users. I have uploaded the list of users both as file and lookup. I am not able to get the search to only return the list of users. search info below. Thanks!

index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])"
AND
|inputlookup UserList.csv | rename "Garbage Name" as userName

I can not figure out how to get these two searches to merged. Any help would be great thanks!

Tags (3)
0 Karma
1 Solution

nspatel
Explorer

index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])" | fields appname, userName, date | join userName[|inputlookup UserList.csv | rename "Garbage Name" as userName]

Seem to do it thanks!

View solution in original post

0 Karma

acharlieh
Influencer

This is actually pretty easy using subsearches provided you are within limits as listed on that page.

index=prod_index sourcetype=MySource 
| rex field=_raw "&lt;&lt;LOT OF COMPLEX REGEX&gt;&gt;(?&lt;appname&gt;[^]]) (?&lt;userName&gt;[^]])"
| where [inputlookup UserList.csv | rename "Garbage Name" as userName | fields userName]

The results of the subsearch gets expanded into a search expression ((userName="foo") OR (userName="bar") ... ) and put into the parent search.

Additionally, if you're able to build a field extractions in MySource and get rid of the rex command you can even simplify this further to a single search expression:

index=prod_index sourcetype=MySource [inputlookup UserList.csv | rename "Garbage Name" as userName | fields userName]
0 Karma

nspatel
Explorer

index=prod_index sourcetype=MySource | rex field=_raw "<<LOT OF COMPLEX REGEX>>(?<appname>[^]]) (?<userName>[^]])" | fields appname, userName, date | join userName[|inputlookup UserList.csv | rename "Garbage Name" as userName]

Seem to do it thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...