Creating a look up table

Comments

1 comment

  • Official comment
    Avatar
    Raghu Murthy

    Hi Nitesh,

    You can do this easily using the save and lookup operators

    1. Once you run a query to find the data for example

    | count Src_ip, Src_port, Dest_ip, Dest_port

    https://help.sumologic.com/Search/Search-Query-Language/Search-Operators/save#Saving_files_to_a_shared_location

    then you can add
    To save a file to a shared location:

    Include the following at the end of your query:
    ...save /shared/myFolder/mySubFolder/fileName

     


    You can verify that the data is saved by running
    cat /shared/myFolder/mySubFolder/fileName

    Example query

    _sourceCategory = AWS/VPC
    | json "message"
    | parse field=message "* * * * * * * * * * * * * *" as version,accountID,interfaceID,src_ip,dest_ip,src_port,dest_port,Protocol,Packets,bytes,StartSample,EndSample,Action,status
    | count by src_ip,src_port, dest_ip, dest_port
    You can append the line to bottom of above query to create a saved file
    | save /shared/nitesh/ip_list

    Then you can say
    cat /shared/nitesh/ip_list
    to display the results

    You can configure this query as a scheduled search to overwrite the results to shared file

    2. To access the saved file via a lookup operator refer this doc
    https://help.sumologic.com/Search/Search-Query-Language/Search-Operators/lookup

    ------------------------from Doc----------

    Examples
    Type the lookup operator in the Search tab, just as you would any other operator.

    To match the userID string with a users' ID in your CSV, your query could be:

    * | parse "name=*, phone number=*," as (name, phone)
    | lookup email from https://company.com/userTable.csv on name=userName, phone=cell

    ------------------------------

    Hope that helps

    Regards
    Raghu

Please sign in to leave a comment.