Splunk Search

How can I compare values from a lookup file with the indexed data?

Yaichael
Communicator

Hi,

A lookup file, with a single column, was configured for comparing the data that it's already indexed. The lookup table file was uploaded correctly and the lookup definition was done correctly but, I can't seem to come up with the correct query for this.

Any ideas?

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Without know what type of information the lookup contains and how it relates to your indexed data, I'm assuming your lookup has some search part (e.g. sourcetype, host or some keyword you want to search) and you want to see if those search parts appear in your indexed data (may be for specific indexes), you can use lookup in subsearch like this

If your lookup field name has matching field name in your indexed data

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName  ]

If your lookup field name doesn't have matching field name in your indexed data

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName  | rename YourLookupFieldName  as yourIndexedDataFieldName]

If your lookup field is keyword and you're trying to search it in raw events of your indexed data

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName  | rename YourLookupFieldName  as search]

View solution in original post

0 Karma

493669
Super Champion

could you please share sample data and sample lookup data and output what you want to achieve..

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Without know what type of information the lookup contains and how it relates to your indexed data, I'm assuming your lookup has some search part (e.g. sourcetype, host or some keyword you want to search) and you want to see if those search parts appear in your indexed data (may be for specific indexes), you can use lookup in subsearch like this

If your lookup field name has matching field name in your indexed data

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName  ]

If your lookup field name doesn't have matching field name in your indexed data

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName  | rename YourLookupFieldName  as yourIndexedDataFieldName]

If your lookup field is keyword and you're trying to search it in raw events of your indexed data

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName  | rename YourLookupFieldName  as search]
0 Karma

Yaichael
Communicator

Thanks for the reply, somesoni2.

My case is the second example, which I executed but, it isn't returning anything. If I execute the following query separately it does return results:

| inputlookup yourLookupDefinition | table YourLookupFieldName  | rename YourLookupFieldName  as yourIndexedDataFieldName

Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's the search you tried? Hopefully your correctly replace the lookup and field names from my query (field names are case sensitive).

0 Karma

Yaichael
Communicator

I tried the following search:

your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName | rename YourLookupFieldName as yourIndexedDataFieldName]

where yourIndexedDataFieldName is an extracted field. Taking in consideration that field names are case sensitive, I rechecked the query and everything looks fine.

0 Karma

Yaichael
Communicator

The query is correct but, there isn't any data present that matches the values from the lookup file.

Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...