Splunk Search

How to take output from base search and search in lookup for all rows?

amitrinx
Explorer

Hi 
I have a lookup having two fields
| inputlookup ID-Client-Lookup.csv | fields ClientId ClientName

I have a base search
sourcetype="oxygen-standard"
| regex AllClientIDs="^[a-z0-9A-Z]{2,}$"
| stats count by AllClientIDs

I want a query which will take each ClientIDs from my base search and the search in the lookup and give me the Client Names
Can anyone help?

Labels (4)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

 

sourcetype="oxygen-standard"
| regex AllClientIDs="^[a-z0-9A-Z]{2,}$"
| stats count by AllClientIDs
| lookup ID-Client-Lookup.csv ClientID as AllClientIDs OUTPUT ClientName

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

amitrinx
Explorer

It says error in lookup command. Cannot find the source field 'AllCliendID' in the lookup table 'ID-Client-Lookup.csv'.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the spelling of the field names.  The one used in the lookup command must be the same one produced by stats.  I did get the order of arguments wrong, however.  Check my modified answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...