Reporting

How to filter a pivot by values on a lookup table?

cheddargt
Loves-to-Learn

Hello! I have a lookup in the csv format of about 1900 users. I have a panel in which we show application usage for every user, but it's formatted as a pivot.

I'd like to make a new panel that only shows application usage for the users on this specific lookup table. If it wasn't the case of a pivot being used, I'd have to use an inputlookup followed by an index subsearch, but i'm having a hard time figuring out how to do this with the pivot.

This is the code for the current panel

 

 

| pivot Process_Detail
    dc(AppVersion) as "#Versions"
    dc(ProcUser) as "#Users"
    dc(host) as "#Hosts"
    splitrow
    AppName as Name
    filter SessionID > 0
    filter AppName is "*"
    
| eval sortfield = lower ('Name') 
| sort limit=0 sortfield 
| table
    Name
    "#Versions"
    "#Users"
    "#Hosts"

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...