Reporting

How to filter a pivot by values on a lookup table?

cheddargt
Loves-to-Learn

Hello! I have a lookup in the csv format of about 1900 users. I have a panel in which we show application usage for every user, but it's formatted as a pivot.

I'd like to make a new panel that only shows application usage for the users on this specific lookup table. If it wasn't the case of a pivot being used, I'd have to use an inputlookup followed by an index subsearch, but i'm having a hard time figuring out how to do this with the pivot.

This is the code for the current panel

 

 

| pivot Process_Detail
    dc(AppVersion) as "#Versions"
    dc(ProcUser) as "#Users"
    dc(host) as "#Hosts"
    splitrow
    AppName as Name
    filter SessionID > 0
    filter AppName is "*"
    
| eval sortfield = lower ('Name') 
| sort limit=0 sortfield 
| table
    Name
    "#Versions"
    "#Users"
    "#Hosts"

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...