Splunk Search

How to partially join two lookups?

olegr
Engager

Hello,

Looking for a way to partially join 2 inputlookups.

Lookup 1: username, name

jsmith, John
jdoe, Joe

Lookup 2:username,status

jsmith-sa, enabled

I would like to return a match on jsmith to jsmith-sa but have not been able to figure out how to partially join.  ie search for jsmith* against lookup2 not for exact matches.  The 2nd lookup may have the entire keyword or keyword-something  Search returns:

jsmith,jsmith-sa,enabled

Labels (2)
Tags (2)
0 Karma
1 Solution

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...

View solution in original post

0 Karma

somesoni2
Revered Legend

Best way would be to setup a wildcard match lookup definition as described in this post (you'll have to modify lookup content which contains partial value i.e. Lookup1 to include wildcard).

https://community.splunk.com/t5/Splunk-Search/Wildcards-in-lookup-file/m-p/292586

0 Karma

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...