Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Do a lookup with results of another lookup

$
0
0
Does anyone know if this is possible? I have a search that works that gives me results for a particular user from a csv. | inputlookup ldapsearch_corporate_identities | search identity="particular userid" This lookup gives me the AD information for "particular userid". I have another csv being generated with a list of userids that we want to pull information for. I'm wondering if I can get the first search to run and return results for each user listed in the second csv. Below is what I have so far. The search itself does list each userid in my csv. But I can't seem to get them to work together. Each user id is listed in a column called target_userid. | inputlookup ldapsearch_corporate_identities|search [|inputlookup machines.csv |fields target_userid | dedup target_userid | mvexpand target_userid] | search identity=target_userid

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>