Splunk Search

How to edit my search to match a field in events to a field in a CSV lookup table, and output all corresponding results?


Lookuptable = C360_USERS.csv

I want to get all the results from the lookuptable matching userGID from the query. How do I join these two fields userGID and USERID and get all the information in a table format?

index=MRM | eval array=split(_raw,"*"), userGID=mvindex(array,9)|lookup C360_USER ......
Tags (3)
0 Karma


Try this (lookup match is case sensitive)

index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE


| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE 
0 Karma


Try like this

| inputlookup C360_USERS.csv | search [search index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9 | stats count by userGID | table userGID | rename userGID as USERID] 
0 Karma