Splunk Search

matching lookup file with a search

yap
Explorer

Hi,

I have 2 sets of logs, Log A contains username and hostname whereas Log B contains userid and hostip.

In order to match the hostname to hostip, I have created a lookup table match both the fields.

May I know how can I create a table containing:

Username | hostname | hostip | userid

Tags (1)
0 Karma

BobM
Builder

Hi Yap. Your question is a little vague and there are a few steps to this. So my advice is to take a look at the following page and try to follow it's steps.

Use field lookups to add information to your events

If you are still having problems, come back and let us know where the issue is and we can try to help. Also if you give some example data form each file, it may be possible to teach splunk to update the lookup file for you.

I'd also recommend splunk education as the searching and reporting class has a good module on lookups.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...