Splunk Search

Using lookup tables and searching it twice

rmorlen
Splunk Employee
Splunk Employee

We have a user lookup table that contains information such as username, email, and managername. I can do a lookup to find a user's managername.

| inputlookup userlookup | search username="bob" | fields username, email, manager

From that I would like to get the email address for the manager. Something like:

| inputlookup userlookup | search username="bob"| fields manager | rename manager AS empManager | search [| inputlookup userlookup username=empManager]

Which doesn't work because the syntax is all screwed up (and I'm not good with lookup tables).

Tags (1)
0 Karma
1 Solution

sc0tt
Builder

I think something like this should work:

..search | fields username
| lookup userlookup username OUTPUT manager
| lookup userlookup username as manager OUTPUT emailaddress

Since you have the manager name in the lookup table, it may be a good idea to just include an additional field with the manager's email.

View solution in original post

sc0tt
Builder

I think something like this should work:

..search | fields username
| lookup userlookup username OUTPUT manager
| lookup userlookup username as manager OUTPUT emailaddress

Since you have the manager name in the lookup table, it may be a good idea to just include an additional field with the manager's email.

rmorlen
Splunk Employee
Splunk Employee

Thank you. That worked.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...