Lookup search

Abhirup_10 · ‎12-10-2023

I have a csv file with the user list and I want to create an alert to monitor the user login failure alert from the user list. How do I use the lookup file, can you please let me know?

richgalloway · ‎12-10-2023

You need more than a CSV file to monitor the users. Presuming you are logging user login failures in Splunk, you can filter them using the CSV file like this.

index=foo [ | inputlookup mylookup.csv | fields <<user name field>> | rename <<user name field>> AS <<indexed user name field>> ]

---
If this reply helps you, Karma would be appreciated.

Lookup search

lookup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation

Lookup search

lookup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform