Hello, I am new to Splunk and this is probably a basic query. I have a field with an email address and I want to check if the email exists in a look up table and eval it to 1, if found and 0 if not.
I also have multiple emails in the field and this is what I have come up with so far, any help is much appreciated.
| rename "my_user.user_email" as email | mvexpand email | stats count by email | eval useremail= email."@my_domain.com" | table useremail count | lookup userdomain_email email as useremail OUTPUT user as user
But this gives me counts and Im not sure if the result is accurate either. Thanks!
(Clicked Enter by mistake and for some reason I cannot edit or delete the above. So here goes)
| eval in_lookup = if(isnull(user), 0, 1)
Hi @Tika,
you could run something like this:
your_search
| rename "my_user.user_email" as email
| mvexpand email
| stats count by email
| eval useremail= email."@my_domain.com"
| append [ | inputlookup userdomain_email | rename email AS useremail | fields useremail ]
| stats sum(count) AS total BY useremail
| eval status=if(total=0,0,1)
| table useremail status
Ciao.
Giuseppe
Thanks! that works
(Clicked Enter by mistake and for some reason I cannot edit or delete the above. So here goes)
| eval in_lookup = if(isnull(user), 0, 1)