Hello Splunk members!
I currently have a search that produces "Users" connecting to certain "hosts" whereas the status of connection is "created". The output is displayed as | timechart span=d dc(users) by host
Here is a sample of how my search currently look like:
index=search "remote access" (host="1.1.1.1" OR host="2.2.2.2" OR host="3.3.3.3")
| eval host = case(host="1.1.1.1", "server1", host="2.2.2.2","server2", host="3.3.3.3", "server3")
| rex field=_raw "\shas\sbeen\s\(?P<status>(created))\."
| rex field=msg "\(SPI=\s(?P<session_id>\w+)\)"
| timechart span=d dc(users) by host
Now my aim is to have a lookup file (User-site.csv) the lookup has 2 fields.
1. Unique user ID
2. Site code
I would like to filter out users based on site. For example, I want my timechart to only produce results for site "ABC" where users connected to.
The user ID on the lookup is not 100% a match to (users) field on the initial search so I think I need to have something like "like" command to compare similar characteristics from my lookup user ID field with users and then filter out the events based on site code (i.e. ABC)
I would appreciate your assistance with this, I have previously made this work but this time the lookup fields are not 100% match so I can't figure a way to use a LIKE command here.
Thanks
MJA411
