I am trying to create a search that returns events where a field's value equals any value from a specific column of a lookup table...
Lookup Table:
Account, Email, User
abc, abc@z.com, a
def, def@z.com, d
ghi, ghi@z.com, g
Desired Search:
Index=myIndex act="abc" OR act="def" OR act="ghi"
My lookup table has hundreds of rows. How do I perform this simple search where the field "act" can equal any value from the "Account" column in my lookup table? Thanks in advance for the help!
rename the lookup field "Account" to the search field name "act", then use the lookup in a subsearch, (it will convert to condition like A=1 OR A=2 OS A=3 etc...)
Index=myIndex [ | inputlookup mylookup.csv | eval act=Account | table act ]
see https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Useasubsearch