Splunk Search

I need help working with a Lookup Table...

TorbinIT
Path Finder

Hello again!

I'm working with two different sources of data both tracking the same thing but coming from different sources. I need to consolidate them into one single Splunk search, so I decided to turn one of the two sources of data into a lookup table for the other.

Right now the lookup table I'm using has 3 Fields in it: HostName, Domain, and Tanium.

What I'd like to do is load the 3 fields from this Lookup into my Splunk Search so that:

1) the HostName field from the lookup is merged with the HostName field in the search, with unique HostName values from the search and the lookup both available in the final output, but also that if there's duplicate values for HostName, they're merged together.

2) The Domain and Tanium values from the Lookup are loaded into their corresponding entries in the final output.

Is this possible? I believe it should be if I use the command:

| lookup WinrarTaniumLookup.csv HostName OUTPUT Tanium Domain

But when I put in that command it doesn't appear to be adding any unique HostName values from the Lookup, just merging the HostName values that both the lookup and the search share. 

What am I doing wrong here?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<search>
| append
  [| inputlookup WinrarTaniumLookup.csv]
| stats values(*) as * by HostName

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<search>
| append
  [| inputlookup WinrarTaniumLookup.csv]
| stats values(*) as * by HostName

TorbinIT
Path Finder

That worked, thank you!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...