Splunk Search

output lookup search correlation with input lookup data

brdr
Contributor

Hello, can you use a output lookup table just after creating it? I have this search...

index=indexA sourcetype=mystA | table src | outputlookup new.csv
| search index=indexB sourcetype=mystB [| inputlookup new.csv | rename src as src_ip ]
| table user
| lookup user.csv AS user OUTPUT displayName

When I run this I get no data found, however, when I separate out the outputlookup command and the subsearch and run I get results as expected.

0 Karma

brdr
Contributor

reposted initially as an Answer: reposting as a comment:

My use case is:
I need a count of users by there business units. To do this I do:
output list IPs as seen in blue coat logs
index=indexA sourcetype=mystA | table src | outputlookup new.csv
using this list (new.csv) match on IP to get user name from our authentication data (indexB) to display business unit
| search index=indexB sourcetype=mystB [| inputlookup new.csv | table src | rename src as src_ip ]
| table user
| lookup user.csv uname as user OUTPUT displayName businessUnit
| stats count by businessUnit

0 Karma

brdr
Contributor

My use case is:

I need a count of users by there business units. To do this I do:

  • output list IPs as seen in blue coat logs
    index=indexA sourcetype=mystA | table src | outputlookup new.csv

  • using this list (new.csv) match on IP to get user name from our authentication data (indexB) to display business unit
    | search index=indexB sourcetype=mystB [| inputlookup new.csv | table src | rename src as src_ip ]
    | table user
    | lookup user.csv uname as user OUTPUT displayName businessUnit
    | stats count by businessUnit

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I don't think you can do that. What's your use case here?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...