Splunk Search

CSV Lookup for search query

Abdulm1
Explorer

I have a search query like this

index=ppt sm.to{}="12-12-518@dt.com" OR sm.to{}="050920@cp.com" |table sm.to{} sm.stat

and I want to use a csv lookup instead because I have more email address to use and I want the result to show this two fields .

My csv contains this
sm.to{}
050920@cp.com
12-12-518@dt.com
774211@PP.com
859@dat.com
20909@PP.com
07548@pp.com

Can anyone help with a lookup search query for me . thanks.

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Try this:

index=ppt | lookup .csv sm.to{} OUTPUT sm.to{} as sm_to | search sm_to = *

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

Try this:

index=ppt | lookup .csv sm.to{} OUTPUT sm.to{} as sm_to | search sm_to = *

Abdulm1
Explorer

am actaully using inputlookup so i used the below command but it did not work

index=proofpoint sourcetype=pps_maillog | inputlookup smto OUTPUT sm.to{} as sm_to | search sm_to = *

I tried the following as well but did not work
index=ppt
| eval Recipients='sm.to{}'
| table Recipients
| search Recipients = "*"
| join type=inner Recipients
[| inputlookup smto
| table sm.to{} sm.stat]

0 Karma

Abdulm1
Explorer

Thanks @manjunathmeti it worked perfectly.

index=ppt | lookup .csv sm.to{} OUTPUT sm.to{} as sm_to | search sm_to = * | table sm_to sm.stat

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

May be it's due to field name, rename sm.to{} to smto in csv file and search query and try.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...