Splunk Enterprise Security

Passing Variable to Inputlookup

geekf
Path Finder

I am running a query to find the list of users that received an email from a particular email address. This is working fine until I try to get more details by using Inputlookup. I want to use Inputlookup to get more details about the users like their department, location, etc which can only be done through that. I need to pass the results from the search to get the other details. The search lists all the userids since I strip out the domain by using the regex.

Here is my query:

sourcettype=sendmail to=*
[ search sourcetype=sendmail from=email@gmail.com
| fields qid]
| rex field=orig_recipient "(?[^@]+)"
| dedup orig_recipient
| inputlookup append=t identity_lookup_expanded where * identity=$orig_recipient$]
| table orig_recipient dept email some other fields

Any help would be appreciated!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The $ operator only applies in the map command and when referencing inputs to a dashboard.
Why use inputlookup here? Why not lookup identity_lookup_expanded email as orig_recipient OUTPUT bunit, work_city, work_country?

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The $ operator only applies in the map command and when referencing inputs to a dashboard.
Why use inputlookup here? Why not lookup identity_lookup_expanded email as orig_recipient OUTPUT bunit, work_city, work_country?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

geekf
Path Finder

This worked perfectly!
Thanks a lot for your prompt response...

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>