Splunk Search

Why are my search results are not matching the lookup table?

raghav130593
Explorer

I am performing a search where I am making use of a CSV lookup and only get those results that match one of the fields in the lookup. Here's my scrubbed out search

index="logs"|regex url = "..."|stats sum(bytes),count(uri) by url ip|lookup csv_lookup ip OUTPUT oe|sort -sum(bytes)

This gives out results with the unmatched events along with the matched events. Any idea what's going wrong?

0 Karma
1 Solution

lquinn
Contributor

If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=" to the end of your search. Then only events with the field *oe, which has come from your lookup, will be retained.

View solution in original post

0 Karma

lquinn
Contributor

If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=" to the end of your search. Then only events with the field *oe, which has come from your lookup, will be retained.

0 Karma

raghav130593
Explorer

Great. Sorry I have very limited experience with Splunk hence wasn't aware of that. But, I was able to achieve my result through what you suggested. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...