I would like to find occurences of Name and Prename in email logfiles and only report that ones that match both column of an inputlookup table.
an Event from the email Server contains Envelop-Sender(suser),Recipient(duser), Content-Sender(from) and some more fields that are not interesting for this task.
My inputlookup table names.csv looks like
name,prename,comment
smith,winston,added on 15.05.20
when using two subsearches in a regular search like the following
index="mail" sourcetype="mailserver" direction="incoming" [| inputlookup names.csv | eval from="*".name."*"| fields from| format] [| inputlookup names.csv| eval from="*".prename."*"| fields from| format] | fields suser,duser,from| format]
all Matches are displayed. Matches for "name" and for "prename".
I tryed to use the WHERE clause but the from field is not existing in the Input lookup table. i did not manage to find a regex that can search for both fields content (name and prename) in the same eval clause Independent of the location of the search Patterns in the target string.
Maybe if clauses can be used in nested form?
I tryed also some join like this
(index="mail" sourcetype="mailserver" direction"incoming" [| inputlookup names.csv | eval from="*".prename."*"| fields from| format] ) join type=inner from ([ search index="mail" sourcetype="mailserver" direction="incoming" [| inputlookup names.csv| eval from="*".name."*"| fields from| format]]) |table _time,suser,duser,from
But did not get any Matches, also the data do have from entries with both values (name,prename) in it.
The lookup-table names.csv was created to be case-insensitive.
Is there a way to join two Subsearches and get only the values that matched both searches ?
Or is there an easy way to use a eval clause on a single field that can search for two search Patterns at the same time ?
(Independent of Location of pattern in searchfield)
Thank You
... View more