Splunk Search

Can you help me create a lookup table for fields coming from Azure Monitoring Data Add-On?

Path Finder

We're using the Azure Monitoring Data Add-on to integrate Splunk and Azure. The Azure events have the subscription ID value (fields name is am_subscriptionId) in each of the events. I would like to be able to put a name/email address to the subscription. I have a lookup table configured which has the fields subscriptionID, subscriptionName, and subscriptionContact. I have attempted to use lookups to no avail. Below is my search. I would like to have a table result with the am_subscriptionId, subscriptionName, and subscriptionContact displayed.

index=* sourcetype=amal:security 
| lookup azure_subscription_id_to_support_group subscriptionID AS am_subscriptionId OUTPUT subscriptionName
0 Karma
1 Solution

Splunk Employee
Splunk Employee

This issue may have to do with case sensitivity on lookups. By default, lookups are case sensitive, but you can change this by modifying transforms.conf like so:

[azure_subscription_id_to_support_group]
case_sensitive_match = 0
filename = azure_subscription_id_to_support_group.csv

Or, you can do this in the UI too by going to Settings -> Lookups -> Lookup definitions -> azure_subscription_id_to_support_group -> Advanced options -> uncheck Case sensitive match

alt text

Everything else looks good.

View solution in original post

Splunk Employee
Splunk Employee

This issue may have to do with case sensitivity on lookups. By default, lookups are case sensitive, but you can change this by modifying transforms.conf like so:

[azure_subscription_id_to_support_group]
case_sensitive_match = 0
filename = azure_subscription_id_to_support_group.csv

Or, you can do this in the UI too by going to Settings -> Lookups -> Lookup definitions -> azure_subscription_id_to_support_group -> Advanced options -> uncheck Case sensitive match

alt text

Everything else looks good.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!