Splunk Search

Filter a search result with lookup values- What command is most appropriate for this?

iammax
Explorer

Hi,

I have a search query where a field is named "user_email".
I also have a lookup table where I have a list of emails.

Now I want my search query to only show results where "user_email" is present in the lookup table that I have.

What command is most appropriate for this? 

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you're looking for something in a lookup table then the correct command to use is lookup.  You look for the given value in the table and get some other field from the lookup table in response.  If the response is not NULL then the value exists in the lookup.

| lookup mylookup.csv user_field OUTPUT foo
| where isnotnull(foo)

 

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...