Splunk Search

lookup table question

Path Finder

Hello everyone.


  • I'm periodically given a .csv file provided to me from a team in my company.
  • I need to create a lookup table with the .csv file provided.
  • Need to run a search on a field in the lookup table "SESS_ID"
  • Correlate the "SESSID" with "IPAddress" found in the index=stream_s
  • update lookup table or provide .csv with new "IP_Address" field, extract and send back to team that provided .csv for investigation purposes

How to go about this? Making is repeatable and easy?

Thanks everyone.

0 Karma


Instead of creating a lookup file from the .csv that is provided, why not just ingest the .csv file into an index? Something like this:

1) Setup a new input file monitor to watch for the provided .csv files to be added to a directory.

2) Have the other team copy any new file into that directory.
3) Splunk ingests input .csv file into new sessidcsv index
4) Create a scheduled report that correlates the two indexes
5) Provide access to this report by the teams or have the report e-mailed back to the group that provided the .csv file.

There's always more than one way to do it. But, this is more 'self-service' for your groups.

Good luck.