Splunk Search

Lookup Table

mailmetoramu
Explorer

Hello All,

Actually i have an lookup table DIUSERS.csv, i would like to build a query as like below :

index=* |inputlookup DIUSERS.csv|stats count by src dest user name action index

But its not working, Please let me know the correct queries.

 

Thanks.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What problem are you trying to solve with the lookup file?  Debugging a query is difficult without knowing the goal.

Have you read the Search Reference manual to see the differences between inputlookup and lookup?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Callie Skokos: Hello and welcome to another episode of "Splunk Smartness," the interview series where we ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...