Inputlookup usage

[Mohsin123]

I have an inputlookup table with list of email addresses . I already have a pre existing field called user . How do I use this inputlookup with only those values which are present in my lookup table and the user field

below is my search query :

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user

I am using this query for the purpose of finding the searches made by the users .
And I have a lookup table , UserEmail with list of users who no longer exist but have scheduled searches still running . These user name are in user field also . I have to use my lookup table user values to result in my query

Thanks

[DalJeanis]

There are two different commands here. You want lookup, not inputlookup.

inputlookup is a generating command that adds all the records from the lookup file into the search.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/inputLookup

lookup is a "join-type" command that uses data from the existing event as a key to look up additional data from the lookup table, and add it to the existing event if found.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Lookup

[DEAD_BEEF]

Assuming the following:

1. lookuptable is named lookuptable.csv when uploaded to splunk in the Destination filename box
2. column header (cell A1) is called user
3. field in your logs is called user
4. entries in lookuptable match EXACTLY to what is in your logs

.

| inputlookup lookuptable.csv | fields user 
| stats count by user search _time

[DalJeanis]

@DEAD_BEEF - I like your style of stating your assumptions. Great practice. You are missing an open brace [, please update.

You could also optionally adjust your code to assume the output from his current search, which could come in the top of your code as if the last command had been...

| table user time search

... so you'd change your first line to (before the subsearch) have a where clause or a search clause on the prior results.

[somesoni2]

Does your lookup table has exact user name values which matches values of field "user" from above search?

[Mohsin123]

yes exact