Splunk Search

Filter a search result with lookup values- What command is most appropriate for this?

iammax
Explorer

Hi,

I have a search query where a field is named "user_email".
I also have a lookup table where I have a list of emails.

Now I want my search query to only show results where "user_email" is present in the lookup table that I have.

What command is most appropriate for this? 

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you're looking for something in a lookup table then the correct command to use is lookup.  You look for the given value in the table and get some other field from the lookup table in response.  If the response is not NULL then the value exists in the lookup.

| lookup mylookup.csv user_field OUTPUT foo
| where isnotnull(foo)

 

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...