hi all,
i hope you can help. i have the below search where i a csn of 4000+sessionID's and i need to find a uniquereference from each of the sessions.
If i manually type in the session ID then it works fine but the lookup doesn't seem to want to work as a filter.
(Session= the lookup title and X-Session-ID is the event session id in splunk i am trying to match together before grabbing the uniquereference from the audit).
- | lookup sessionslookup.csv Session
| spath output=uniquereference1 input=detail.responseMessage path=reference1
| spath output=uniquereference2 input=detail.responseMessage path=reference2
| table Session X-Session-ID
| rename Session as X-Session-ID
| table X-Session-ID saUTR saUTR2
any ideas
