Splunk Search

How to join the result of an inputlookup and the output of a search?

kemnean2001
New Member

I have the following inputlookup

| inputlookup ad_identities |search sAMAccountName=unetho |table sAMAccountName, displayName, userPrincipalName

result:

ABCDE   First LastName  emailadress

index=pan_logs rule="VL-PROD_VL-LAPTOPS-no-log" src_user=*unetho 
|eval user_id=substr(src_user , 9, len(src_user )) 
|table user_id, app  | dedup user_id

result

ABCDE   SSL

The result id need is:

ABCDE   First LastName  emailadress    SSL    
where (ABCDE from 1ste query)= (ABCDE from 2e query)
0 Karma

vishaltaneja070
Motivator

@kemnean2001

Below query will help you:

    | inputlookup ad_identities |search sAMAccountName=unetho |table sAMAccountName, displayName, userPrincipalName | rename sAMAccountName as user_id
    | join user_id
    [search index=pan_logs rule="VL-PROD_VL-LAPTOPS-no-log" src_user=*unetho
    |eval user_id=substr(src_user , 9, len(src_user ))
    |table user_id, app | dedup user_id] | table user_id, displayName, userPrincipalName , app 

ayushchoudhary
Path Finder

Hello kemnean2001,

join command is used to join to searches having atleast one same field.

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Join

this link might help you.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...