Splunk Search

matching lookup file with a search

Explorer

Hi,

I have 2 sets of logs, Log A contains username and hostname whereas Log B contains userid and hostip.

In order to match the hostname to hostip, I have created a lookup table match both the fields.

May I know how can I create a table containing:

Username | hostname | hostip | userid

Tags (1)
0 Karma

Builder

Hi Yap. Your question is a little vague and there are a few steps to this. So my advice is to take a look at the following page and try to follow it's steps.

Use field lookups to add information to your events

If you are still having problems, come back and let us know where the issue is and we can try to help. Also if you give some example data form each file, it may be possible to teach splunk to update the lookup file for you.

I'd also recommend splunk education as the searching and reporting class has a good module on lookups.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!