Splunk Search

Is it possible to use the join command to join data from an index with a lookup table?

New Member


I want to know if it is possible to use a join command with inputlookup instead of a lookup to join data between an index and a lookup table.


Index=firewalls |join type=inner overwrite=false dstip [inputlookup maliciousIP.csv] |stats count  srcip by dstip, malwareName
| join type overwrite=false srcip [inputlookup UserIP.csv]  |table count, dstip, malwareName, srcip, username,

The UserIP.csv is generated every hour after this the search will run.
Fyi this is not the exact search, but just an example. The reason I want to use join instead of lookup is that the lookup list has many additional columns and I want to keep the search as simple and short as possible and want to get some input to see how others handle this..

Hope to get some ideas from this.

0 Karma

Super Champion

I have a search where I do this. Mine looks something like

...|join type=left field [ |inputlookup lookup.csv]...
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!