Splunk Search

How to edit my search to match a field in events to a field in a CSV lookup table, and output all corresponding results?

athorat
Communicator

Lookuptable = C360_USERS.csv
Fields: USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

I want to get all the results from the lookuptable matching userGID from the query. How do I join these two fields userGID and USERID and get all the information in a table format?

index=MRM | eval array=split(_raw,"*"), userGID=mvindex(array,9)|lookup C360_USER ......
Tags (3)
0 Karma

sundareshr
Legend

Try this (lookup match is case sensitive)

index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

*OR*

| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE 
0 Karma

somesoni2
Revered Legend

Try like this

| inputlookup C360_USERS.csv | search [search index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9 | stats count by userGID | table userGID | rename userGID as USERID] 
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...