Splunk Search

How to partially join two lookups?

olegr
Engager

Hello,

Looking for a way to partially join 2 inputlookups.

Lookup 1: username, name

jsmith, John
jdoe, Joe

Lookup 2:username,status

jsmith-sa, enabled

I would like to return a match on jsmith to jsmith-sa but have not been able to figure out how to partially join.  ie search for jsmith* against lookup2 not for exact matches.  The 2nd lookup may have the entire keyword or keyword-something  Search returns:

jsmith,jsmith-sa,enabled

Labels (2)
Tags (2)
0 Karma
1 Solution

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...

View solution in original post

0 Karma

somesoni2
Revered Legend

Best way would be to setup a wildcard match lookup definition as described in this post (you'll have to modify lookup content which contains partial value i.e. Lookup1 to include wildcard).

https://community.splunk.com/t5/Splunk-Search/Wildcards-in-lookup-file/m-p/292586

0 Karma

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...
0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...