I have an index called weblogs and a csv lookup called socialmedia that contains 3 columns called URL TYPE and NAME. I would like to create list of users who go to one of the sites listed on the lookup. Is this possible to do?
Sure, that's pretty easy! Given that your lookup is very short, the most efficient way to do this is to use |inputlookup
to search only on the URLs you're looking for, and then output the usernames from the matching events:
index=weblogs [|inputlookup socialmedia | fields URL]
And assuming the events you get out of that search contain fields called username
and url
, you can just pipe the results to a stats command to see which users visited which URLs:
| stats values(url) AS url BY username
So all together it's this:
index=weblogs [|inputlookup socialmedia | fields URL] | stats values(url) AS url BY username
Here's some good guidance on using the inputlookup
command:http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup
Sure, that's pretty easy! Given that your lookup is very short, the most efficient way to do this is to use |inputlookup
to search only on the URLs you're looking for, and then output the usernames from the matching events:
index=weblogs [|inputlookup socialmedia | fields URL]
And assuming the events you get out of that search contain fields called username
and url
, you can just pipe the results to a stats command to see which users visited which URLs:
| stats values(url) AS url BY username
So all together it's this:
index=weblogs [|inputlookup socialmedia | fields URL] | stats values(url) AS url BY username
Here's some good guidance on using the inputlookup
command:http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup