Splunk Search

Inputlookup - Pulling Mutiple columns

OiskyPoisky
Explorer

Morning Community,

Looking at a way to pull multiple columns into an alert Im attempting to build. In the below syntax this gives me hits on the a src IP that appears in the lookupfile which is great however I also want to pull in extra columns associated with the hit on that IP.

The lookup file contains columns labelled "tag" "info" and "comment" which would further enhance the usefulness of this alert.

index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN | search [| inputlookup my.csv | rename value as src | fields src ]

I've tried this and returns no results.

index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN
| search [| inputlookup my.csv | rename value as src | fields src ]
| lookup my.csv info as src.info output info as src.info

Any thoughts at all? This article was a little similar to what Im trying to do, except I need the extra columns data from the src IP hits from the 1st part of the alert.  https://community.splunk.com/t5/Splunk-Search/Pulling-multiple-Columns-from-an-inputlookup/m-p/42474...

Labels (1)
0 Karma
1 Solution

saravanan90
Contributor

Below may help..

index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN | lookup my.csv value as src outputnew  info as src.info

View solution in original post

0 Karma

to4kawa
Ultra Champion

index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN  [| inputlookup my.csv | rename value as src | fields src | format ]
| lookup my.csv info as src.info output info as src.info

 

But you don't have the src field, do you?

0 Karma

saravanan90
Contributor

Below may help..

index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN | lookup my.csv value as src outputnew  info as src.info

0 Karma

OiskyPoisky
Explorer

Thanks this worked great!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...