Splunk Search

lookup username from seperate search

justinhart
Path Finder

I am performing a search on some data that contains the computername, drive letter, and path of drives mapped to the computer. I also have a second search that returns the username associated with the computer. How can I add a field to the first search that ties the computername in search 1 to the username in search 2. Can I do this with a eval/subsearch or by doing a lookup to a csv file?

Thanks.

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

You can probably do this by a subsearch if you just want to find a mapped paths, drive letter etc from a single user, but it's a bit hard to say since you don't give all that much information of your desired output or sample logs.

Otherwise you might have to resort to a join, which is rather expensive.

The join approach would give you something like

sourcetype=A | join COMPUTERNAME [search sourcetype=B | fields COMPUTERNAME, USER_NAME] | table USER_NAME, COMPUTERNAME, DRIVELETTER, PATH

More information would allow you to get better help.

/Kristian

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

You can probably do this by a subsearch if you just want to find a mapped paths, drive letter etc from a single user, but it's a bit hard to say since you don't give all that much information of your desired output or sample logs.

Otherwise you might have to resort to a join, which is rather expensive.

The join approach would give you something like

sourcetype=A | join COMPUTERNAME [search sourcetype=B | fields COMPUTERNAME, USER_NAME] | table USER_NAME, COMPUTERNAME, DRIVELETTER, PATH

More information would allow you to get better help.

/Kristian

0 Karma

justinhart
Path Finder

Thanks, this seemed like the easiest way to get what I was wanting.

0 Karma

Kate_Lawrence-G
Contributor

I think a subsearch would do the trick if you need to look up the username/computername data dynamically.

sourcetype=<src-1> computername=* 
[source=<src-2> computername=* | fields username ] 
| stats values(username)....by computername

But if you had a list of computernames and usernames available as a CSV you could do a lookup table as well at the end.

sourcetype=* | stats values(computername) AS computername | lookup user_table computername OUTPUT username AS "User"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...