Reporting

not able to display a column displaying data from a lookup table

ajromero
Path Finder

I have this search that actual display all the data I want, but I need to add one more column to display the user full name, so far I get this display

here is the query:

sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=RECEIVE) user_bunit=Energy (recipient_domain="x.com" OR recipient_domain="x.com")
| stats count as RECEIVE by recipient
| append [search sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=SEND) user_bunit=Energy (recipient_domain="x.com" OR recipient_domain="x.com")
|stats count as SEND by recipient]
| append [search sourcetype=MSExchange:*:MessageTracking user_bunit=Energy tag=delivery (recipient_domain="x.com" OR recipient_domain="x.com")
| stats count as delivery by recipient]
|lookup EnergyAD.csv src_user_nick as src_user_nick
| stats values(SEND) as SEND,values(RECEIVE) as RECEIVE, values(delivery) as delivery, values(src_user_nick) as src_user_nick by recipient

| rename recipient as "Email Account" SEND as "Outbound Messages" RECEIVE as "Inbound Messages" delivery as "Internal Messages"

displays this: it does not show anything under src_user_nick (which is the user full name)

ajromero_0-1593022776205.png

 

Labels (1)
Tags (1)
0 Karma

The_Simko
Path Finder

In your example, the lookup table isn't using any fields to do the lookup with.  

What field matches in the lookup table? I'm guessing recipient
So you'd need:   

| lookup EnergyAD.csv recipient OUTPUT src_user_nick

The above needs recipient to match a field named recipient. See https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Lookup

 

ajromero
Path Finder

that solve the issues thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...