Lookup Table - Splunk Community

Splunk Search

Hello All,

Actually i have an lookup table DIUSERS.csv, i would like to build a query as like below :

index=* |inputlookup DIUSERS.csv|stats count by src dest user name action index

But its not working, Please let me know the correct queries.

Thanks.

What problem are you trying to solve with the lookup file? Debugging a query is difficult without knowing the goal.

Have you read the Search Reference manual to see the differences between inputlookup and lookup?

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...