Getting Data In

Enrich Data with Lookup File

stevenbutterwor
Path Finder

Hi all

I'm trying to enrich sone data with a csv lookup file. I've created the csv and defined the lookup but I can't get it to output for some reason. What am I doing wrong? Search below:

eventtype="domainsecuritylog" EventCode=4624 | top user,Logon_Type showperc=false | lookup logontype Logon_Code OUTPUT Logon_Code, Logon_Description

As you can see I'm searching for a windows event code which contains a Logon_type number. I'm then trying to match the number to the description in the lookup file.

Any help would be much appreciated!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi stevenbutterworth,
you have to put much attention on three points:

  • key field name must be the same both in search and lookup, and field name is case sensitive.
  • when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
  • then check if there are spaces in the lookup key field.

Bye.
Giuseppe

View solution in original post

stevenbutterwor
Path Finder

Thanks cusello

It was your first point that was the issue. I had to RENAME a field so it matched the lookup file.

Thanks

Steve

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi stevenbutterworth,
you have to put much attention on three points:

  • key field name must be the same both in search and lookup, and field name is case sensitive.
  • when you're sure about field name, check if lookup key field values are present in search results, or if there's some case difference,
  • then check if there are spaces in the lookup key field.

Bye.
Giuseppe

niketn
Legend

@stevenbutterworth, if @cusello's answer resolved your issue, please accept the same to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...