I have a search I use to associate a "likely" user to an IP
search query | dedup src | fields src user |inputlookup src_user.csv append=true | dedup src |table src, user| outputlookup src_user.csv
I am not getting accurate results and my theory is....
The results are appended to the end of the table. Splunk reads the table from top to bottom. Splunk gets the first match and then stops. The first match is old data.
Does my search look correct? How can I fix this?
Update...
I think I identified one issue. I studied by lookup table and there are no duplicate IPs, but there are duplicate users. I want the table to represent the last know IP associated with a user. If a new IP is associated with a user, remove the old entry.
Ideas????
