Splunk Search

How to partially join two lookups?

olegr
Engager

Hello,

Looking for a way to partially join 2 inputlookups.

Lookup 1: username, name

jsmith, John
jdoe, Joe

Lookup 2:username,status

jsmith-sa, enabled

I would like to return a match on jsmith to jsmith-sa but have not been able to figure out how to partially join.  ie search for jsmith* against lookup2 not for exact matches.  The 2nd lookup may have the entire keyword or keyword-something  Search returns:

jsmith,jsmith-sa,enabled

Labels (2)
Tags (2)
0 Karma
1 Solution

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...

View solution in original post

0 Karma

somesoni2
Revered Legend

Best way would be to setup a wildcard match lookup definition as described in this post (you'll have to modify lookup content which contains partial value i.e. Lookup1 to include wildcard).

https://community.splunk.com/t5/Splunk-Search/Wildcards-in-lookup-file/m-p/292586

0 Karma

olegr
Engager

That did not work for me, but I ended up figuring it out using the following:

| inputlookup lookup1.csv
| rex field=User "^(?<UserShort>.+?)\-suffix"
| eval identity = if(isnull(UserShort), User, UserShort)
| join identity [inputlookup lookup2]
...
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...