Splunk Search

Filter Email Address Country of Origin Using Lookup

griffins
Explorer

Assume I have a simple search that lists in a table the email addresses of those who recently sent an email:

index=email | table sender

 The email index does not have a field that identifies the country the sender address is from; however, it is known that the listed sender addresses are from many different countries. If I have a lookup that contains all the email addresses located in the US using the format:

email country
address1@mail.com US
address2@mail.com US
...

 How can I filter my search results to only contain sender email addresses from those located in the US (based off of the lookup), while also adding a field to the table that shows US?

Labels (1)
0 Karma
1 Solution

anilchaithu
Builder

@griffins 

you can use something simple like this

 

index=email | table sender | lookup lookup_name email as sender output country | dedup country

 

OR you can try with subsearch. Since the query only searches the senders from the lookup you can add country as US

 

index=email [ | inputlookup lookup_name | rename email as sender | table sender | format] | eval country="US" | table sender country 

 

 

Hope this helps 

View solution in original post

anilchaithu
Builder

@griffins 

you can use something simple like this

 

index=email | table sender | lookup lookup_name email as sender output country | dedup country

 

OR you can try with subsearch. Since the query only searches the senders from the lookup you can add country as US

 

index=email [ | inputlookup lookup_name | rename email as sender | table sender | format] | eval country="US" | table sender country 

 

 

Hope this helps 

griffins
Explorer

@anilchaithu This works great! Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...