Splunk Search

How to join table of usertypes with user detail

spammenot66
Contributor

I have a table of users and their position level across an organization. How would i join the table of positions and get their internal & external ids  and fill in the column with bold green fonts

Desired tabled:

Name LevelInternal IDExternal ID
User 1Level1904787ZZ88985
User 2Level2 927819ZZ55135
User 3Level2 701876ZZ64157
User 4Level3166387ZZ89635
User 5Level373914ZZ93585
User 6Level3394497ZZ65026
User 7Level3200662ZZ99972
User 8Level3925192ZZ94890
User 9Level4254770ZZ45273
User 10Level4174055ZZ55961
User 11Level4344944ZZ81383
User 12Level4114436ZZ37757
User 13Level4672453ZZ68642
User 14Level4992512ZZ82497
User 15Level4915758ZZ33143

 

Based on the two tables below:

table of positions. 

Level 1Level2 Level3Level4
User 1User 2User 4User 9
User 1User 2User 4User 10
User 1User 2User 5User 11
User 1User 2User 6User 12
User 1User 3User 6User 13
User 1User 3User 7User 14
User 1User 3User 8User 15

 

User ID Detail

UserIDInternal IDExternal ID
User 1773236ZZ60307
User 2720417ZZ91613
User 3327957ZZ36532
User 4865654ZZ28800
User 5128875ZZ67338
User 6858309ZZ60570
User 7878572ZZ56897
User 8804657ZZ72104
User 990130ZZ13737
User 10983968ZZ68473
User 1133431ZZ88498
User 12205262ZZ93466
User 13505492ZZ45170
User 14876947ZZ91395
User 15229730ZZ18609
Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Transpose the positions table so it can be joined to the userid table

| makeresults | eval _raw="Level1,Level2,Level3,Level4
User 1,User 2,User 4,User 9
User 1,User 2,User 4,User 10
User 1,User 2,User 5,User 11
User 1,User 2,User 6,User 12
User 1,User 3,User 6,User 13
User 1,User 3,User 7,User 14
User 1,User 3,User 8,User 15"
| multikv forceheader=1
| fields - _* linecount
| stats values(*) as *
| transpose 0 column_name=Level
| rename "row 1" as UserID
| mvexpand UserID

View solution in original post

tscroggins
Influencer

@spammenot66 

Expanding on @ITWhisperer's answer:

| inputlookup spammenot66_levels.csv
| stats values(*) as *
| transpose 0 column_name=Level
| rename "row 1" as UserID
| mvexpand UserID
| inputlookup append=t spammenot66_users.csv
| stats values(Level) as Level values(External ID) as "External ID" values(Internal ID) as "Internal ID" by UserID
| rename UserID as Name
| rex field=Name "(?<sort_key>\d+)"
| sort 0 sort_key
| fields - sort_key

ITWhisperer
SplunkTrust
SplunkTrust

Transpose the positions table so it can be joined to the userid table

| makeresults | eval _raw="Level1,Level2,Level3,Level4
User 1,User 2,User 4,User 9
User 1,User 2,User 4,User 10
User 1,User 2,User 5,User 11
User 1,User 2,User 6,User 12
User 1,User 3,User 6,User 13
User 1,User 3,User 7,User 14
User 1,User 3,User 8,User 15"
| multikv forceheader=1
| fields - _* linecount
| stats values(*) as *
| transpose 0 column_name=Level
| rename "row 1" as UserID
| mvexpand UserID

spammenot66
Contributor

@ITWhisperer@tscroggins  - I finally figured out a solution a couple hours after posting this. But your solution is by far, more elegant and simpler than mine. Thank you 3000

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...