Splunk Search

How to combine results of inputlookup and a search to a table?

tcpcannon
Loves-to-Learn Lots

I want to search from a lookup table, get a field, and compare it to a search and pull the fields from that search based off of a common field. I would rather not use |set diff and its currently only showing the data from the inputlookup.

 

 

 

 

| set diff
[| inputlookup all_mid-tiers WHERE host="ACN*" 
    | fields username Unit ]
    [ search index=iis 
        [| inputlookup all_mid-tiers WHERE host="ACN*" 
        | fields username ] 
    | dedup username 
    | dedup SiteIDOverride
    | eval username=lower(username) 
    | fields username SiteIDOverride unitType installVer os jkversion
        ] 
| join type=left
    [ search index="iis" sourcetype="iis" earliest=-7d@d 
        [| inputlookup all_mid-tiers Where host="*ACN*" 
        | fields username]   
    | dedup username 
    | eval username=lower(username) 
    | eval timedelta=now()-_time 
    | eval time_delta_days=floor(timedelta/86400) 
    | stats first(time_delta_days) as Status by username 
    | eval Status=if(Status<"0","0",Status) 
    | eval StatA=Status 
    | rangemap field=StatA OK=0-0 Monitor=1-1 Contact=2-9999 
    | rename range as Status 
        ] 

| lookup all_mid-tiers host AS SiteIDOverride OUTPUT Unit Weaponsystem Last_access
| eval Last_access=strftime(Last_access, "%Y-%m-%d")
| rename Weaponsystem as unitType
| dedup Unit

| table Status Unit SiteIDOverride unitType installVer os jkversion Last_access

 

 

I can't seem to get it to pull SiteIDOverride unitType...^^ from the search. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...