Monitoring Splunk

How to use a csv file to extract a details corresponding to a value extracted by a Splunk Query.

Real_captain
Path Finder

Hi Team 

Can you please help me to provide a solution to use a csv file with the external vs internal user id data in the splunk. 

Below is the current query and output that extracts the internal userid and i need another column to add corresponding external user id. 

Csv file : ABC.csv 

usr_id,eml_add_ds

internal user id 1 , external user id 1
internal user id 2 , external user id 2
internal user id 3 , external user id 3
internal user id 4 , external user id 4
Query : 

(index=ABC) ("Start" OR "Finish")   Properties.AspNetCoreEnvironment="*"
| rex field=Message "Start:\s*(?<start_info>[^\s]+)"
| rex field=Message "user\s(?<Userid>[^\took|.]+)"
| search start_info=*
| table Userid
| sort time

 

Output : 

Real_captain_0-1726675143560.png

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...