lookup in the event

[newbiesplunk]

Hi,
If my event does not contain the user field, and i need to have the automatic lookup for the user info based on the user=1234 as the example below, what will be the approach? thks
2/26/15 10:03:30 AM 1.1.1.1 - 1234 xxxxx

[cpetterborg]

Here is what I would do to get the data for the user (you will have to make appropriate substitutions that you want for your search):

<your-search-data> | rex field=_raw " \d+\.\d+\.\d+\.\d+\.\d+\s+-\s+(?P<user>[^ ]+" | lookup <lookuptablename> user OUTPUT fullname

where your lookuptablename table (csv) has data like this:

user,fullname
1234,John Doe
5678,Larry Bird
2468,Jack B Nimble

The rex command should get the user after the IP and dash (-). Then that is used to do the lookup in the table to get the user's fullname from the table. That fullname will then be found in the field fullname.

So you will have to tailor the CSV file with the proper names and fields (you can have more than one that is returned, so you could have more than 2 columns in the CSV file that you submit as the lookup table. If your data is far different from the example, you will have to make adjustments in the field extraction in the rex command as well.

satishsdange gives a good reference to understanding the lookup tables.

[satishsdange]

Hi -

You can create a lookup to enrich raw unstructured data with structured data. e.g. user1=1234, user2=3456
Below link provides information about creating lookup -
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usefieldlookupstoaddinformationtoyoureve...

Hope this helps.

[cpetterborg]

You say the event doesn't contain the user field, but then 1234 in your example is the user? Is 1234 the user or not?

Then you want to do an auto lookup of additional data for that user (which the user (1234) is actually in the event)? Right?

[newbiesplunk]

Hi, 1234 is the user found in the event but was not tag to the field "user".

[markthompson]

I can see where @cpetterborg is coming from, the question is not that easy to understand. Would you mind clarifying what you're attempting to do?

From what I can gather, you want the "1234" as shown in your example to be known as the User field, for which you would need a rex.

And then you want to look this up in a table?