Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Lookup Table: Link more than one field (sender, receiver) from each event to a look up table value (email, firstname, lastname)

$
0
0
We have email events and want to link sender and receiver email addresses to the user data in a lookup table. **Events:** sender = user1@email.com receiver = user2@email.com **Lookup Table:** user1@email.com, firstname, lastname, city, state user2@email.com, firstname, lastname, city, state What is an efficient search to get to the following search result: **Sender Email Sender State Receiver Email Receiver State** user1@email.com CA user2@email.com NY Thanks for any input!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>