Splunk Search

How do I match two fields from the same join command?

Path Finder

Splunkers,

Search String:

admon-user-lookup-update

| eval src_user = (cn) 
| fields src_nt_domain, displayName, cn
| rename cn as user 
| join user 
    [ search index=winevents (EventCode=630 OR EventCode=4726 OR Eventcode=4720 OR EventCode=4725) dest_nt_domain="xxxx" 
    | fields user, action, ComputerName, EventCode, EventCodeDescription, src_user, status]

I am able to match "cn" with user to produce a display name correlation between userid and full name.. How can I match src_user to use display name as well?

0 Karma
1 Solution

Contributor

Unfortunately, the sub-search will run first, then the Splunk will run the main search. Try MAP.

View solution in original post

0 Karma

Esteemed Legend

If you will show a minimal set of sample events and the desired result, I will answer your question. I do not at all understand the way that you have explained your problem but I am certain that it is solvable.

0 Karma

Splunk Employee
Splunk Employee

Hi @matthew.foos ,

Did the answer below solve your problem? If so, please resolve this post by approving it!

If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

Contributor

Unfortunately, the sub-search will run first, then the Splunk will run the main search. Try MAP.

View solution in original post

0 Karma