matching lookup file with a search

[yap]

Hi,

I have 2 sets of logs, Log A contains username and hostname whereas Log B contains userid and hostip.

In order to match the hostname to hostip, I have created a lookup table match both the fields.

May I know how can I create a table containing:

Username | hostname | hostip | userid

[BobM]

Hi Yap. Your question is a little vague and there are a few steps to this. So my advice is to take a look at the following page and try to follow it's steps.

Use field lookups to add information to your events

If you are still having problems, come back and let us know where the issue is and we can try to help. Also if you give some example data form each file, it may be possible to teach splunk to update the lookup file for you.

I'd also recommend splunk education as the searching and reporting class has a good module on lookups.