Monitoring Splunk

How to use a csv file to extract a details corresponding to a value extracted by a Splunk Query.

Real_captain
Path Finder

Hi Team 

Can you please help me to provide a solution to use a csv file with the external vs internal user id data in the splunk. 

Below is the current query and output that extracts the internal userid and i need another column to add corresponding external user id. 

Csv file : ABC.csv 

usr_id,eml_add_ds

internal user id 1 , external user id 1
internal user id 2 , external user id 2
internal user id 3 , external user id 3
internal user id 4 , external user id 4
Query : 

(index=ABC) ("Start" OR "Finish")   Properties.AspNetCoreEnvironment="*"
| rex field=Message "Start:\s*(?<start_info>[^\s]+)"
| rex field=Message "user\s(?<Userid>[^\took|.]+)"
| search start_info=*
| table Userid
| sort time

 

Output : 

Real_captain_0-1726675143560.png

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...