Splunk Search

Internal lookup

mrdaniel
Explorer

I need to do a lookup on search result with data from splunk internal. I have a log which logs when a user login and what PID that user get assigned to such as:

PID: 2938 [DATE]

22: Command [username]

In the same log the actions the user takes during the session is logged with the following format:

PID: 2938 [DATE]
22: Command [custom data]

Now i would like to generate an report using this data and translate the PID to a username using lookup. The result would be a table with Username, PID and Command.

When i search for lookup information i can find that i can do lookups from scripts or CSV files, not from Splunk queries, is it possible to do such query?

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You could either use the join or transaction command to combine the metadata of 2 searches.

Or use stats to aggregate the information on a unqiue key:

<search maching both events> | stats first(Command) as Command first(Username) as Username by PID

Another, more complicated option is to write a scripted lookup or a command which can execute searches in Splunk. But I don't think this is necessary.

View solution in original post

0 Karma

mrdaniel
Explorer

Thanks i had to modify this a bit as there are more than one Command, so I use

| stats list(Command) as Command first(Username) as Username by PID

0 Karma

ziegfried
Influencer

You could either use the join or transaction command to combine the metadata of 2 searches.

Or use stats to aggregate the information on a unqiue key:

<search maching both events> | stats first(Command) as Command first(Username) as Username by PID

Another, more complicated option is to write a scripted lookup or a command which can execute searches in Splunk. But I don't think this is necessary.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...