Elegant solution. ... View more

A lookup will search for your value in your column <lookup-field> and will join the matching row to your dataset. The problem in the case of a single column CSV is that you don't have any value to join. You should add a B column to your CSV like is_member and set it to true or 1 for all your row, so if your lookup finds a match it will join the value is_member to it, then you can make an even like if(is_member="true", <then something>) ... View more

Since recent version, you can now do this from the WEBUI, it may worth an edit ? ... View more

I just ran into your answer since I had the same issue, to slightly improve performance (I think - didn't measure) I did a pre-filter on the tstat using wildcards so I give less results to search , then narrow the results with search (in my case I needed to filter all private IPs) as you suggested | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where ( All_Traffic.dest=10.* OR All_Traffic.dest=192.168.* OR All_Traffic.dest=172.* ) AND All_Traffic.action="allowed" AND ( All_Traffic.transport="tcp" OR All_Traffic.transport="udp" ) by All_Traffic.dest | search All_Traffic.dest=10.0.0.0/8 OR All_Traffic.dest=192.168.0.0/16 OR All_Traffic.dest=172.16.0.0/12 In my case the wildcards we almost enough since it works well for /16 and /8, but I still needed to use a CIDR search for 172.16.0.0/12. ... View more

A lookup should always be like id,member 1,user1 2,user2 3,user3 you need a header row at the top, those will be your <lookup-field> . If your event-field is the same as you lookup-field you don't need to specify it in the lookup command, otherwise you just need to map it with <lookup-field> AS <event-field> ... View more

Then your input in your lookup will be the field A1 | your ldap search | lookup <lookup-table-name> <lookup-field> AS <event-field> where <lookup-field> will be your csv header you want to match and <event-field> will be in this case A1 ... View more

You need to take into account the fields names. @eliotproebstel ask you data structure but I think you missed the columns name which is very important, I assume A1 member A2 userID A3 userID A4 userID are your data or are A1 member your headers ? Does your csv has headers too ? ... View more

Thanks for the answer and the workaround ! ... View more

Can you provide a small dataset ? ... View more

It actually works as expected, don't forget that splunk will run your pipes one by one, searches is not compiled. If we take this search (1) (2) | eval name=if(id="xyz", "unknown", name) At (1) your field name will only exists where there is a value, for all rows, it will not be blank, it will not exist and hence be null so at step (2) you will assign null to you field name If you add a fill null between (1) (2) | fillnull value="" name (3) | eval name=if(id="xyz", "unknown", name) now at step (2) you field name exist and is set to blank (or whatever value you set). ... View more

You need to use lookup and not inputlookup . lookup will take an input field and will fetch the other values found in your csv for the matching row to your data. inputlookup can only be used at the beginning of a query as a datasource or with the parameter append=T but this will just append the csv to your base search. ... View more

You need to do the opposite, first fill nulls, then do your eval. ... View more

If I understand you question correctly, you have cases where ID="XYZ" but you name is null. In that case you need to use | fillnull value="" name before your eval to make sure your names are at least blank (otherwise by default it will be unset hence null ). ... View more

All those aliases, transforms and so on are sourcetype based, can you check if you apply the proper sourcetype to your data ? ... View more

I'm not sure to understand your question, when do you have null ? ... View more

Most of the apps you will find will be "IT oriented" I doubt you'll find prebuilt things for this use case. But at the end of the day, Splunk is just a database, you can fill it with any data you want as long as you can retrieve them. If for example your sensors write their output in a file, then it's super easy to import them and start building dashboards. If they have REST API's it will require some tweaking but you can easily get them as well. Anyway you can always add some "middleware" in the form of a python script or whatever that your Splunk can use to get the data. ... View more

Usually when I try to compare dates I tend to convert them to a number, do the math, and reformat them in dates. You can use strptime (http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/DateandTimeFunctions) that will take your date as input and return you an epoch that you can easily compare since it's a number. Combine that with streamstats or eventstats to get the result you want. ... View more

Are you looking for a usecase or an anwser "it's possible or not" ? ... View more