Splunk Search

matching lookup file with a search

yap
Explorer

Hi,

I have 2 sets of logs, Log A contains username and hostname whereas Log B contains userid and hostip.

In order to match the hostname to hostip, I have created a lookup table match both the fields.

May I know how can I create a table containing:

Username | hostname | hostip | userid

Tags (1)
0 Karma

BobM
Builder

Hi Yap. Your question is a little vague and there are a few steps to this. So my advice is to take a look at the following page and try to follow it's steps.

Use field lookups to add information to your events

If you are still having problems, come back and let us know where the issue is and we can try to help. Also if you give some example data form each file, it may be possible to teach splunk to update the lookup file for you.

I'd also recommend splunk education as the searching and reporting class has a good module on lookups.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...