Can I match indexed data to a CSV with a lookup?

[bgill0123]

I have an index called weblogs and a csv lookup called socialmedia that contains 3 columns called URL TYPE and NAME. I would like to create list of users who go to one of the sites listed on the lookup. Is this possible to do?

[elliotproebstel · Accepted solution]

Sure, that's pretty easy! Given that your lookup is very short, the most efficient way to do this is to use |inputlookup to search only on the URLs you're looking for, and then output the usernames from the matching events:
index=weblogs [|inputlookup socialmedia | fields URL]

And assuming the events you get out of that search contain fields called username and url, you can just pipe the results to a stats command to see which users visited which URLs:
| stats values(url) AS url BY username

So all together it's this:
index=weblogs [|inputlookup socialmedia | fields URL] | stats values(url) AS url BY username

Here's some good guidance on using the inputlookup command:http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup