Splunk Search

How do I edit my search on usernames to also table associated passwords?

mohanmk1905
New Member

I am getting Username and User id Fields while search using username, then I pipe it and search user ID to get the password. How to put them in a table TABLE USERNAME USERID PASSWORD like this.

index!=_internal "USERNAME" | TABLE USERNAME USERID | SEARCH index!=_internal "$USERID$" | TABLE USERNAME USERID PASSWORD

The search above is not working.

0 Karma

mohanmk1905
New Member

Sorry i didn't convey my question correctly.- This is not an exact scenario but i am trying to make a similar scenario.

Let me explain it clearly.

After First search - i am able to take USERNAME AND USERID in a table.

First search : index = something "USERNAME" | table USERNAME USERID

Second search - i am searching all the USERID feilds taken in first search and taking password in the second search for that userid . so i am take USERID and PASSWORD table here.

index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD

i am able to join two searches using join

index = something "USERNAME" | table USERNAME USERID | join USERID [SEARCH index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD ] | table USERNAME USERID PASSWORD.

But i feel like i am using the same search (index = something "USERNAME" ) twice in the join scenario.
Please how to get that three feild in one search itself

0 Karma

inventsekar
Ultra Champion

Hi mohanmk,
Please check this one -

index!=_internal "USERNAME" OR "$USERID$" | TABLE USERNAME USERID PASSWORD

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mohanmk1905,
After a table command, the only fields you have are the ones you listed in table: in your example you haven't PASSWORD field in the first table, so, in the following pipes you haven't PASSWORD field, but only USERNAME and USERID.

Every way it's strange the way you have to build your search:

  • why do you use index!=_internal? if you use index=* you have the same result!
  • if you can, try to express indexes in your search (index=main OR index=web...): it's more efficient;
  • why do you use fields search in two points? it's more efficient to have only one search as first as possible;
  • I think that "USERNAME" is a word and not a field, if it's a field you have to insert in your search USERNAME="$USERNAME$" or a value.

Probably your search is better like something:

index=* "USERNAME" "$USERID$" | TABLE USERNAME USERID PASSWORD

Bye.
Giuseppe

0 Karma

mohanmk1905
New Member

sorry sir i conveyed my question correctly now

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mohanmk1905,
every way the problem is the same: if you haven't password field in the first table command, you haven't it in the second one, try the search I suggested: the output of a command on the left of the pipe "|" is the input for the command on the right of the pipe "|".
bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...