Splunk Search

Filter a search result with lookup values- What command is most appropriate for this?

iammax
Explorer

Hi,

I have a search query where a field is named "user_email".
I also have a lookup table where I have a list of emails.

Now I want my search query to only show results where "user_email" is present in the lookup table that I have.

What command is most appropriate for this? 

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you're looking for something in a lookup table then the correct command to use is lookup.  You look for the given value in the table and get some other field from the lookup table in response.  If the response is not NULL then the value exists in the lookup.

| lookup mylookup.csv user_field OUTPUT foo
| where isnotnull(foo)

 

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

Two approaches

Subsearch

your_search [ | inputlookup your_lookup.csv | fields user_email ]

or Lookup

your_search 
| lookup your_lookup.csv user_email OUTPUT user_email as found_email
| where isnotnull(found_email)

To some extent your choice will depend on what you prefer, but also data volume, size of lookup, which both affect performance.

If the email list is large, then the subsearch is probably not the best option, but you can look at the job inspector to see which on has the best performance for your data

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...