Splunk Enterprise Security

Update a Lookup Table with Identity information coming from our index "elist"

Path Finder

I need to update a Lookup Table with Identity information coming from our index "elist", I am trying get the search to take the events from the elist and compare it to the current lookup table, If the identity already exists in the lookup table then it will not add anything, but if doesn't it will add it. But also I would like it to check the end Date and if not null it will add the new information. This is what I have so far. the eList and the Lookup have different fields so I have to rename everything to match. Thanks!

index="elist" | search LoginID="MV123456" | rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, HireDate AS startDate, TermDate AS endDate, ST AS work_location, Phone AS phone| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, work_location, work_country | outputlookup simple_identity_lookup append=t

0 Karma
1 Solution

Motivator

Try below SPL.

index="elist" 
| search LoginID="MV123456" 
| rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, HireDate AS startDate, TermDate AS endDate, ST AS work_location, Phone AS phone 
| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, work_location, work_country 
| search NOT 
    [| inputlookup simple_identity_lookup 
    | table identity]
| outputlookup simple_identity_lookup append=t

View solution in original post

0 Karma

Motivator

Try below SPL.

index="elist" 
| search LoginID="MV123456" 
| rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, HireDate AS startDate, TermDate AS endDate, ST AS work_location, Phone AS phone 
| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, work_location, work_country 
| search NOT 
    [| inputlookup simple_identity_lookup 
    | table identity]
| outputlookup simple_identity_lookup append=t

View solution in original post

0 Karma

Motivator

@MikeVenable
Can you accept the answer if it's helped you? Thanks.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!