Splunk Search

Can I match indexed data to a CSV with a lookup?

bgill0123
New Member

I have an index called weblogs and a csv lookup called socialmedia that contains 3 columns called URL TYPE and NAME. I would like to create list of users who go to one of the sites listed on the lookup. Is this possible to do?

0 Karma
1 Solution

elliotproebstel
Champion

Sure, that's pretty easy! Given that your lookup is very short, the most efficient way to do this is to use |inputlookup to search only on the URLs you're looking for, and then output the usernames from the matching events:
index=weblogs [|inputlookup socialmedia | fields URL]

And assuming the events you get out of that search contain fields called username and url, you can just pipe the results to a stats command to see which users visited which URLs:
| stats values(url) AS url BY username

So all together it's this:
index=weblogs [|inputlookup socialmedia | fields URL] | stats values(url) AS url BY username

Here's some good guidance on using the inputlookup command:http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup

View solution in original post

elliotproebstel
Champion

Sure, that's pretty easy! Given that your lookup is very short, the most efficient way to do this is to use |inputlookup to search only on the URLs you're looking for, and then output the usernames from the matching events:
index=weblogs [|inputlookup socialmedia | fields URL]

And assuming the events you get out of that search contain fields called username and url, you can just pipe the results to a stats command to see which users visited which URLs:
| stats values(url) AS url BY username

So all together it's this:
index=weblogs [|inputlookup socialmedia | fields URL] | stats values(url) AS url BY username

Here's some good guidance on using the inputlookup command:http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.