Splunk Search

append lookup help

mcbradford
Contributor

I have a search I use to associate a "likely" user to an IP

search query | dedup src | fields src user |inputlookup src_user.csv append=true | dedup src |table src, user| outputlookup src_user.csv

I am not getting accurate results and my theory is....

The results are appended to the end of the table. Splunk reads the table from top to bottom. Splunk gets the first match and then stops. The first match is old data.

Does my search look correct? How can I fix this?

Update...

I think I identified one issue. I studied by lookup table and there are no duplicate IPs, but there are duplicate users. I want the table to represent the last know IP associated with a user. If a new IP is associated with a user, remove the old entry.

Ideas????

Tags (1)
0 Karma

lukejadamec
Super Champion

It looks like you need to configure Maximum Matches in the Advanced Options of the lookup definition.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...