Splunk Search

Filter a search result with lookup values- What command is most appropriate for this?

iammax
Explorer

Hi,

I have a search query where a field is named "user_email".
I also have a lookup table where I have a list of emails.

Now I want my search query to only show results where "user_email" is present in the lookup table that I have.

What command is most appropriate for this? 

Labels (5)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you're looking for something in a lookup table then the correct command to use is lookup.  You look for the given value in the table and get some other field from the lookup table in response.  If the response is not NULL then the value exists in the lookup.

| lookup mylookup.csv user_field OUTPUT foo
| where isnotnull(foo)

 

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...