Splunk Search
Highlighted

append lookup help

Contributor

I have a search I use to associate a "likely" user to an IP

search query | dedup src | fields src user |inputlookup srcuser.csv append=true | dedup src |table src, user| outputlookup srcuser.csv

I am not getting accurate results and my theory is....

The results are appended to the end of the table. Splunk reads the table from top to bottom. Splunk gets the first match and then stops. The first match is old data.

Does my search look correct? How can I fix this?

Update...

I think I identified one issue. I studied by lookup table and there are no duplicate IPs, but there are duplicate users. I want the table to represent the last know IP associated with a user. If a new IP is associated with a user, remove the old entry.

Ideas????

Tags (1)
0 Karma
Highlighted

Re: append lookup help

Super Champion

It looks like you need to configure Maximum Matches in the Advanced Options of the lookup definition.