Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About m4jk3l
m4jk3l
Explorer
Member since:
02-22-2024
02-28-2024
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-22-2024 |
Activity Feed
- Posted Re: How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-28-2024 04:27 AM
- Posted Re: How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-23-2024 03:13 AM
- Posted Re: How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-23-2024 02:01 AM
- Posted Re: How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-23-2024 01:47 AM
- Posted Re: How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-23-2024 01:31 AM
- Posted Re: How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-23-2024 01:23 AM
- Posted How to search all fields from a lookup CSV file in index event log on Splunk Search. 02-22-2024 06:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
02-28-2024
04:27 AM
When I extracted the Field from the Event Log and I named it as "ClientName" it started to work.
... View more
02-23-2024
03:13 AM
index=my_index [| inputlookup blank_clients.csv | table ClientName | rename ClientName AS search] "Certificate was successfully validated" If I execute just this code, I get all the ClientName entries: | inputlookup blank_clients.csv | table ClientName | rename ClientName AS search
... View more
02-23-2024
02:01 AM
Each ClientName is in a separate row
... View more
02-23-2024
01:47 AM
I was a bit too quick in accepting your Answer as Solution. Now it seems that the search is looking just for the first ClientName in the lookup file and ignoring all the rest. If I put the ClientName that I am sure will be in the event log as first entry it works. When I put the ClientName as 3rd or 4th Entry in the Column it doesnt find the event.
... View more
02-23-2024
01:31 AM
it works 🙂 Thank you!
... View more
02-23-2024
01:23 AM
Thank you for you reply. For some reasons it doesn't work yet. index=my_index [| inputlookup blank_clients_test.csv | table ClientName] "Certificate was successfully validated" For test purposes in the blank_clients_test.csv I have just put a single ClientName I get 0 results When I search for the following: index=my_index BB-H-282XY "Certificate was successfully validated" I am getting a match in the event. What could be wrong? Does the second Column in the lookup table is also included? If, yes then it would not work. I want to exclude the second column in the lookup HWDetSystem Thanks!
... View more
02-22-2024
06:30 AM
Hello Splunk members! I have a CSV Lookup file with 2 columns ClientName HWDetSystem BD-K-027EY VMware I have an index with ASA Firewall log which I want to search and find events for all the ClientNme in the CSV 234654252.234 %ASA-3-2352552: Certificate was successfully validated. serial number: 1123423SSDDG23442234234DSGSGSGGSSG8, subject name: CN=BD-K-027EY.bl.emea.something.com. Between the CSV lookup file and event the common is the ClientName and a portion of the subject name. If I look for successfully and provide a single client name i get the event I want, but I am struggling to look it up for all the clients and make it uniqe. At the end I just want a list of ClientName for which the even was logged. thanks
... View more
Labels
- Labels:
-
lookup
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-28-2024
04:28 AM
|
