Getting Data In

Multiple fields to filter against Single inputlookup file

gopiven
Explorer

Hi Experts

Actually I am searching on one index, where Userid is with multiple fields like user,userids,useridvalue,user_id etc., on the events ( since it is from multiple source types). And I want to check this ids against one input lookup that contains all the Userid (only one column in lookup) and table it.
But it is not working for me. Since I am new to this platform could someone assist me please.

index= "user_prod" [ input lookup Userid.csv |rename user as Userid | rename userids as Userid | rename useridvalue as Userid | rename user_id as Userid | fields Userid ] | table Userid

Please note: inputlookup filename name and inside column name are similar - Userid

Thanks in advance!

0 Karma
1 Solution

jpolvino
Builder

One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:

index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid

View solution in original post

0 Karma

jpolvino
Builder

One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:

index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid
0 Karma

gopiven
Explorer

Thanks jpolvino !
It works now!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...