Help with Splunk search?

[sulaimancds]

index=mail [ | inputlookup 123.csv | rename address AS query | fields query ]
| dedup MessageTraceId
| lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match
| where isnull(domain_match)
| lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2
| where isnotnull(domain_match2)
| stats values(RecipientAddress) as Recipient values(Subject) as Subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" values(Status) as Status by RecipientDomain SenderAddress
| eval subject_count=mvcount(Subject)
| sort - subject_count
| convert ctime("Latest")
| convert ctime("Earliest")

hi i have another column call date in the 123.csv , after running the query, those results which match the csv , show the date as well from 123.csv in 1 column. Please help.

[ITWhisperer]

There is nothing in the search that you posted that would suggest how this might be happening - 123.csv in only used to get a list of addresses, not dates.

Please can you share some (anonymised) examples of where you are seeing this issue?

[sulaimancds]

the search query is working perfectly , i just need to show the dates from the csv. example if i run the search and the user matches for example 123@gmail.com , the date on the 123.csv for this user is 22/05/2023. It should show the date as well

[ITWhisperer]

OK - can you not simply do a lookup on 123.csv?

[sulaimancds]

i try but not showing so i need your help with the query,

[ITWhisperer]

What have you tried so far?

[sulaimancds]

i use table  and tried to put in stats and on the first line also to show , please help 

[ITWhisperer]

If you want more help, you will have to be more specific as to what exactly you have tried. I lost my mind-reading license after a misunderstanding with an African Prince!

[sulaimancds]

---

@ITWhisperer wrote:

If you want more help, you will have to be more specific as to what exactly you have tried. I lost my mind-reading license after a misunderstanding with an African Prince!

---

hi

i tried last week to rename [date AS date | fields date ] in first line 

table at the last line i cannot remember , 

[ITWhisperer]

It is not clear from the way you appear to be approaching this what it is that you are actually trying to achieve. Please can you share some anonymised sample events, examples of the csv files and an explanation of the desired results.

[sulaimancds]

this is the current result.  in my csv, there are 2 columns date and address - which is the sender address, which currently the query is working as shown above. after running the query, if there are any results, the date from the csv also should be shown in of the columns in the result table.

RecipientDomain	SenderAddress	Recipient	Subject	Earliest	Latest	Status	subject_count
gmail.com	abc@abc.com.xy	abc@gmail.com	form	05/16/2023 14:50:11.069507	05/18/2023 23:52:08.009636	Delivered	10

[ITWhisperer]

index=mail [ | inputlookup 123.csv | rename address AS query | fields query ]
| dedup MessageTraceId
| lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match
| where isnull(domain_match)
| lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2
| where isnotnull(domain_match2)
| stats values(RecipientAddress) as Recipient values(Subject) as Subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" values(Status) as Status by RecipientDomain SenderAddress
| eval subject_count=mvcount(Subject)
| sort - subject_count
| convert ctime("Latest")
| convert ctime("Earliest")
| lookup 123.csv address AS SenderAddress OUTPUT date

[sulaimancds]

in my csv there are 2 colums , Event date and address

address is used for sender address to match the criteria.

so, after the query is run , if there are any results, the date from the csv, should be shown with the results.

the command which you gave i think it is wrong.

[ITWhisperer]

In what way is it wrong? What happened when you tried it?

[sulaimancds]

in my csv there are 2 colums , Event date and address

address is used for sender address to match the criteria.

so, after the query is run , if there are any results, the Event date from the csv, should be shown with the results in another column

the command which you gave i think it is wrong.

[sulaimancds]

The search job has failed due to an error. 

[ITWhisperer]

Please explain how being evasive helps your cause?

[sulaimancds]

sorry i do not understand your question

[ITWhisperer]

How do you think providing short, and not very informative answers helps anyone help you solve your problem?

[sulaimancds]

i have provided everything , i am sorry if i did not 

[ITWhisperer]

There was an error in what you just replied