Splunk Search

How do you use an inputlookup to search through all event fields?

asp82
New Member

I have a one column lookup. I want to see if any of the values in the lookup appear in ANY field of my events. And I want any matching events to be returned. Is there a way to do this? Thank you in advance

Lookup name ActivityTest, lookup field name CustomerID (this field name is not a field name in the events)

0 Karma

bryhenderson
Explorer

You can probably accomplish the search by using a subsearch and changing the field name to search (example below). This will cause the search to just look at the value of your field in the lookup table as opposed to field="value".

search index="test" [|inputlookup ActivityTest|rename CustomerID AS search|fields + search]
0 Karma

asp82
New Member

Thanks for the suggestion.

I tried this and got 138 results using a test lookup with 5 customerIds. If I manually search for these 5 ids, I get a total of 634 results. Looking at the events that are excluded from the first query but present in the second one's results, it's not clear to me that there's any meaningful difference. Any clue why these matches would drop out?

Also, I structured CustomerID in the lookup as 123 so that it shouldn't matter if something comes immediately before or after it.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...