Eval against a lookup

[Tika]

Hello, I am new to Splunk and this is probably a basic query. I have a field with an email address and I want to check if the email exists in a look up table and eval it to 1, if found and 0 if not. 

I also have multiple emails in the field and this is what I have come up with so far, any help is much appreciated.

| rename "my_user.user_email" as email | mvexpand email | stats count by email  | eval useremail= email."@my_domain.com" | table useremail count | lookup userdomain_email email as useremail OUTPUT user as user 

But this gives me counts and Im not sure if the result is accurate either.  Thanks!

[gcusello]

Hi @Tika,

you could run something like this:

your_search
| rename "my_user.user_email" as email 
| mvexpand email 
| stats count by email  
| eval useremail= email."@my_domain.com" 
| append [ | inputlookup userdomain_email | rename email AS useremail | fields useremail ]
| stats sum(count) AS total BY useremail
| eval status=if(total=0,0,1)
| table useremail status

Ciao.

Giuseppe

[Tika]

Thanks! that works

[yuanliu · Accepted solution]

(Clicked Enter by mistake and for some reason I cannot edit or delete the above.  So here goes)

| eval in_lookup = if(isnull(user), 0, 1)

[yuanliu]

There is only one step from your lookup output to 0-or-1 determination: if(X,Y,Z).