hi ,
I have a lookup file with million of records, there are user name with lower or upper case. I need to match the user name irrespective of case. I have added a lookup defn ( with case sensitive check box unticked). I can see in transform.conf that match_case_sensitive=0
But still search is running with case sensitive.
I am using Splunk 8.0. Any suggestions?
You have to perform your lookup
through the lookup definition
, not the lookup file
so try using lookupsplunk
(or whatever the name of your lookup definition
is), instead of lookupsplunk.csv
, like this:
index="x" AND sourcetype="Y"
| rex "(?:Users%5C)(?(.*))(?:%5C(AppData|Desk))"
| lookup lookupsplunk user AS UserID OUTPUT Office Country UserName
You have to perform your lookup
through the lookup definition
, not the lookup file
so try using lookupsplunk
(or whatever the name of your lookup definition
is), instead of lookupsplunk.csv
, like this:
index="x" AND sourcetype="Y"
| rex "(?:Users%5C)(?(.*))(?:%5C(AppData|Desk))"
| lookup lookupsplunk user AS UserID OUTPUT Office Country UserName
Awesome , thank you very much !!
index="x"
| rex field=_raw "(?:Users%5C)(?<UserID>(.*))(?:%5C(AppData|Desk))"
| inputlookup lookupspluk.csv append=t
| eval UserID=coalesce(lower(UserId),lower(user))
| eventstats values(Office) as Office ,values(Country) as Country ,values(UserName) as UserName by UserID
at first, check your POST message, some strings is missing.
and let's make a lookup with lowercase or uppercase username.
Show us your search SPL.
index="x" | rex field=_raw "(?:Users%5C)(?(.*))(?:%5C(AppData|Desk))" | lookup lookupspluk.csv user as UserID OUTPUT Office,Country,UserName
@woodcock - any suggestions. M still stuck , even though I have the stanza in transform.conf . I have also tried to put 0 in place of false
[ColleagueLookup]
filename = colleaguecountry_splunk_NewSQL.csv
case_sensitive_match = false