Splunk Search

How to edit my search to match a field in events to a field in a CSV lookup table, and output all corresponding results?

athorat
Communicator

Lookuptable = C360_USERS.csv
Fields: USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

I want to get all the results from the lookuptable matching userGID from the query. How do I join these two fields userGID and USERID and get all the information in a table format?

index=MRM | eval array=split(_raw,"*"), userGID=mvindex(array,9)|lookup C360_USER ......
Tags (3)
0 Karma

sundareshr
Legend

Try this (lookup match is case sensitive)

index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

*OR*

| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE 
0 Karma

somesoni2
Revered Legend

Try like this

| inputlookup C360_USERS.csv | search [search index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9 | stats count by userGID | table userGID | rename userGID as USERID] 
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...