Splunk Search

How to partially join two lookups?

olegr
Engager

Hello,

Looking for a way to partially join 2 inputlookups.

Lookup 1: username, name

jsmith, John
jdoe, Joe

Lookup 2:username,status

jsmith-sa, enabled

I would like to return a match on jsmith to jsmith-sa but have not been able to figure out how to partially join.  ie search for jsmith* against lookup2 not for exact matches.  The 2nd lookup may have the entire keyword or keyword-something  Search returns:

jsmith,jsmith-sa,enabled

Labels (2)
Tags (2)
0 Karma
1 Solution

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...

View solution in original post

0 Karma

somesoni2
Revered Legend

Best way would be to setup a wildcard match lookup definition as described in this post (you'll have to modify lookup content which contains partial value i.e. Lookup1 to include wildcard).

https://community.splunk.com/t5/Splunk-Search/Wildcards-in-lookup-file/m-p/292586

0 Karma

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...