Splunk Search

splunk

DougiieDee
Explorer

I have a csv file which has field Account and it has over 1000+. In my logs it is named as yourAccount. how do i find the all the account logs from that csv file. Also can i rex the field and have the table for that as well in same query?

Labels (4)
0 Karma

DougiieDee
Explorer

yourAccount  isnt a field name i have to regex it. Can i rex field yourAccount and search with only the account that i have in csv file?

 

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @DougiieDee 

you can try to rename the Account field in csv to yourAccount  to get the all results from both fields.

example

index=foo sourcetype=bar | table yourAccount 
| lookup file.csv Account as yourAccount 

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...