Splunk Search

Transaction with field from a lookup

mpuigmal
New Member

Hi,

I'm trying to correlate events from 2 different sourcetypes. The “correlation field” is the user email address.
We have the email address under ‘user’ field in the ‘Logs‘ sourcetype but we do not have it in ‘Session’ Logs.
To retrieve the user email from Session Logs, I use a lookup table.
I’ve built the following search :

(sourcetype=Session) OR (sourcetype=Logs AUTH_Status=AUTHN_METHOD_SUCCESS) | lookup UserList sAMAccountName as AccountName OUTPUT userPrincipalName as user | transaction user, startswith="AUTHN_METHOD_SUCCESS" endswith=",Online," maxspan=10m | table user, duration, _time, sourcetype

It seems that the transaction is not done on the field ‘user’ (I can see that in the results).
Does the transaction command support data that comes from a lookup table?
Maybe I miss something else?

Thanks for your help

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming the Session sourcetype does not have field sAMAccountName then the lookup command will not find a match and may be replacing the user field with null. Replacing OUTPUT with OUTPUTNEW may help.

Another approach would be a join:

(sourcetype=Session) | join user [sourcetype=Logs AUTH_Status=AUTHN_METHOD_SUCCESS) | lookup UserList sAMAccountName as AccountName OUTPUT userPrincipalName as user] | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...