Creating a look up table


1 comment

  • Official comment
    Raghu Murthy

    Hi Nitesh,

    You can do this easily using the save and lookup operators

    1. Once you run a query to find the data for example

    | count Src_ip, Src_port, Dest_ip, Dest_port

    then you can add
    To save a file to a shared location:

    Include the following at the end of your query: /shared/myFolder/mySubFolder/fileName


    You can verify that the data is saved by running
    cat /shared/myFolder/mySubFolder/fileName

    Example query

    _sourceCategory = AWS/VPC
    | json "message"
    | parse field=message "* * * * * * * * * * * * * *" as version,accountID,interfaceID,src_ip,dest_ip,src_port,dest_port,Protocol,Packets,bytes,StartSample,EndSample,Action,status
    | count by src_ip,src_port, dest_ip, dest_port
    You can append the line to bottom of above query to create a saved file
    | save /shared/nitesh/ip_list

    Then you can say
    cat /shared/nitesh/ip_list
    to display the results

    You can configure this query as a scheduled search to overwrite the results to shared file

    2. To access the saved file via a lookup operator refer this doc

    ------------------------from Doc----------

    Type the lookup operator in the Search tab, just as you would any other operator.

    To match the userID string with a users' ID in your CSV, your query could be:

    * | parse "name=*, phone number=*," as (name, phone)
    | lookup email from on name=userName, phone=cell


    Hope that helps


    Comment actions Permalink

Please sign in to leave a comment.