Splunk Search
Highlighted

lookup query - using the lookup list as a search filter

New Member

hi all,

i hope you can help. i have the below search where i a csn of 4000+sessionID's and i need to find a uniquereference from each of the sessions.

If i manually type in the session ID then it works fine but the lookup doesn't seem to want to work as a filter.
(Session= the lookup title and X-Session-ID is the event session id in splunk i am trying to match together before grabbing the uniquereference from the audit).

  • | lookup sessionslookup.csv Session | spath output=uniquereference1 input=detail.responseMessage path=reference1 | spath output=uniquereference2 input=detail.responseMessage path=reference2

| table Session X-Session-ID
| rename Session as X-Session-ID
| table X-Session-ID saUTR saUTR2

any ideas

0 Karma