topic Re: Filtered list in Splunk Dev

Filtered list

Bracha — Mon, 04 Dec 2023 10:28:31 GMT

Hi
I have a dashboard that displays CSV
I want to add lists for him to display that are not in the CSV
But the list I'm adding includes the records that are in the CSV
I want to create a list that will not include the records in the CSV

This code gets me the whole list

| index="------" interface="--" |stats values(interface) as importers

This code brings me the list from the CSV

index="------------" code=* | search [|inputlookup importers.csv |lookup importers.csv interfaceName OUTPUTNEW system environment timerange |stats values(interfaceName) as importers_csv

I want a code that brings me the list without the records in the CSV
Thanks

Re: Filtered list

gcusello — Mon, 04 Dec 2023 10:42:11 GMT

Hi @Bracha ,

let me understand: in the importers.csv file you have a list of interfaces and you want to filter your results using the above lookup or you want to check if they are present in the index?

if you want to filter your results using the lookup, you can use a subsearch, putting attention that the field names in main and sub search are the same (in your case interfaceName):

index="------------" code=* [|inputlookup importers.csv | fields interfaceName ] |stats values(interfaceName) as importers_csv

If instead you want to know if there are interfaceNames in the lookup not present in the results of the main search, you have to run something like this:

Ciao.

Giuseppe

Re: Filtered list

Bracha — Mon, 04 Dec 2023 10:51:14 GMT

Hi @gcusello

thank you for your quick response

I have two lists

1. importers - includes many importers

2. importers_csv - contains some of the importers from the first list

I want a list which will contain the importers that are not in the CSV file

How to do it?

Re: Filtered list

gcusello — Mon, 04 Dec 2023 11:25:59 GMT

Hi @Bracha ,

you have to use the first solution:

| inputlookup importers WHERE NOT [ | inputlookup importers_csv | fields interfaceName ]

put attention that the field names are the same (interfaceName).

Ciao.

Giuseppe

Re: Filtered list

Bracha — Mon, 04 Dec 2023 12:06:00 GMT

@gcusello

I want all records that not in csv

Re: Filtered list

gcusello — Mon, 04 Dec 2023 13:10:51 GMT

Hi @Bracha ,

with the above search you have all the records not in csv.

Ciao.

Giuseppe