Splunk Search

Trying to match a field with multiple values against a lookuptable

marktechuk
New Member

I trying to search a lookup table for matching field=user the field contains multiple values for example
user=ID, name, email, address - so when I run the search it only match on email the first value in field user against my lookuptable test1.csv

I there a way for my to split out the values of field user into multiple fields that I can match against my lookuptable.

index=** sourcetype=** event=** | table user | dedup user | lookup test1.csv user outputnew user as matchEvent

0 Karma
1 Solution
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...