Getting Data In

Multiple fields to filter against Single inputlookup file

gopiven
Explorer

Hi Experts

Actually I am searching on one index, where Userid is with multiple fields like user,userids,useridvalue,user_id etc., on the events ( since it is from multiple source types). And I want to check this ids against one input lookup that contains all the Userid (only one column in lookup) and table it.
But it is not working for me. Since I am new to this platform could someone assist me please.

index= "user_prod" [ input lookup Userid.csv |rename user as Userid | rename userids as Userid | rename useridvalue as Userid | rename user_id as Userid | fields Userid ] | table Userid

Please note: inputlookup filename name and inside column name are similar - Userid

Thanks in advance!

0 Karma
1 Solution

jpolvino
Builder

One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:

index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid

View solution in original post

0 Karma

jpolvino
Builder

One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:

index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid
0 Karma

gopiven
Explorer

Thanks jpolvino !
It works now!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...