Splunk Search

How to combine information from 2 different sources like sourcetype=eea:loghandler and lookup file

silviuchiric76
New Member

Dear all

I have 2 data sources: logs forwared to the server as :
sourcetype=eea:loghandler
and lookup definition file as users_with_email

file
called users_with_email.csv

I have a key field in both sources the same:
in sourcetype=eea:loghandler is called user with values like firstname.lastname@domain.com
and in lookup definition file I have email field, same value firstname.lastname@domain.com
and this is the case for all users

I need to get an aggregated reports of users from

sourcetype=eea:loghandler by joining the department field from lookup definition file users_with_email(users_with_email.csv)

When I try to make an OR:
sourcetype=eea:loghandler OR inputlookup users_with_email
got no results

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @silviuchiric76,
you should try something like this:

sourcetype=eea:loghandler
| lookup users_with_email.csv email AS user OUTPUT department
| dedup user
| sort user
| table user department

A little hint: use always index in your searches to have faster results!

Ciao.
Giuseppe

0 Karma

silviuchiric76
New Member

I am interested for an inner join after email.users_with_email = eea:loghandler.user

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...