Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Filter Email Address Country of Origin Using Looku...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assume I have a simple search that lists in a table the email addresses of those who recently sent an email:
index=email | table senderThe email index does not have a field that identifies the country the sender address is from; however, it is known that the listed sender addresses are from many different countries. If I have a lookup that contains all the email addresses located in the US using the format:
email country
[email protected] US
[email protected] US
...How can I filter my search results to only contain sender email addresses from those located in the US (based off of the lookup), while also adding a field to the table that shows US?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can use something simple like this
index=email | table sender | lookup lookup_name email as sender output country | dedup country
OR you can try with subsearch. Since the query only searches the senders from the lookup you can add country as US
index=email [ | inputlookup lookup_name | rename email as sender | table sender | format] | eval country="US" | table sender country
Hope this helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can use something simple like this
index=email | table sender | lookup lookup_name email as sender output country | dedup country
OR you can try with subsearch. Since the query only searches the senders from the lookup you can add country as US
index=email [ | inputlookup lookup_name | rename email as sender | table sender | format] | eval country="US" | table sender country
Hope this helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@anilchaithu This works great! Thank you so much.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Catalog Is Now Generally Available on Splunk Cloud Platform
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
