Splunk Search

How to edit my search to match a field in events to a field in a CSV lookup table, and output all corresponding results?

athorat
Communicator

Lookuptable = C360_USERS.csv
Fields: USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

I want to get all the results from the lookuptable matching userGID from the query. How do I join these two fields userGID and USERID and get all the information in a table format?

index=MRM | eval array=split(_raw,"*"), userGID=mvindex(array,9)|lookup C360_USER ......
Tags (3)
0 Karma

sundareshr
Legend

Try this (lookup match is case sensitive)

index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

*OR*

| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE 
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

| inputlookup C360_USERS.csv | search [search index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9 | stats count by userGID | table userGID | rename userGID as USERID] 
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...