Hello,
Looking for a way to partially join 2 inputlookups.
Lookup 1: username, name
jsmith, John
jdoe, Joe
Lookup 2:username,status
jsmith-sa, enabled
I would like to return a match on jsmith to jsmith-sa but have not been able to figure out how to partially join. ie search for jsmith* against lookup2 not for exact matches. The 2nd lookup may have the entire keyword or keyword-something Search returns:
jsmith,jsmith-sa,enabled
That did not work for me, but I ended up figuring it out using the following:
| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...
Best way would be to setup a wildcard match lookup definition as described in this post (you'll have to modify lookup content which contains partial value i.e. Lookup1 to include wildcard).
https://community.splunk.com/t5/Splunk-Search/Wildcards-in-lookup-file/m-p/292586
That did not work for me, but I ended up figuring it out using the following:
| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...