Splunk Search

Do a lookup with results of another lookup

kmcaloon
Explorer

Does anyone know if this is possible? I have a search that works that gives me results for a particular user from a csv.

| inputlookup ldapsearch_corporate_identities | search identity="particular userid"

This lookup gives me the AD information for "particular userid".

I have another csv being generated with a list of userids that we want to pull information for. I'm wondering if I can get the first search to run and return results for each user listed in the second csv. Below is what I have so far. The search itself does list each userid in my csv. But I can't seem to get them to work together. Each user id is listed in a column called target_userid.

| inputlookup ldapsearch_corporate_identities|search [|inputlookup machines.csv |fields target_userid | dedup target_userid | mvexpand target_userid] | search identity=target_userid

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

|inputlookup machines.csv |fields target_userid | dedup target_userid | mvexpand target_userid | lookup ldapsearch_corporate_identities identity as target_userid 

This will fetch the corresponding AD information for each target_userid.

View solution in original post

kmcaloon
Explorer

Thanks to both of you for the suggestions. This worked perfectly!

0 Karma

somesoni2
Revered Legend

Try something like this

|inputlookup machines.csv |fields target_userid | dedup target_userid | mvexpand target_userid | lookup ldapsearch_corporate_identities identity as target_userid 

This will fetch the corresponding AD information for each target_userid.

martin_mueller
SplunkTrust
SplunkTrust

You should be able to do something like this:

| inputlookup ldapsearch_corporate_identities | search [inputlookup machines.csv | fields target_userid | dedup target_userid | rename target_userid as identity]

I'm a little confused about your mvexpand though, does the machines.csv contain multivalue target_userid fields?

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...