Splunk Search

How to match join ids when lookup produces ambiguous results.


How to match a result from 3 fields using an ambiguous lookup.

lookup client_type.csv

client_id    type           id  id_type
82    AB-25 WWS-1   210 28000-CWS1
83    AB-25 WWS-2   210 28000-CWS2

The main search produces a client_id, and I need to join it to the results above.
As an example, client 82 and client 83 can both have id of 210.

... search with multiple client_id
| join type=left client_id [search index=client_source="updates.ids" earliest=-7d latest=now() | dedup Case sortby -_time | search CaseTitle="*CLIENT ID*" | rex field=CaseTitle "(?.*) CLIENT ID"
| eval id=if(!like(OBJ,"%.%"), upper(trim(OBJ)), null()) 
| lookup id OUTPUT id_type, _client_id

The problem I have is that the id is ambiguous, matching both WWS-1 and WWS-2.

My requirement is that it is OK for both entries to equal each other, but need out output each client_id in order to match the parent search. specifically client_id 82 and 83 can both match WWS-1 or WWS-2

Not sure how to fulfill.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...