topic Re: Comparing lookup to an index in Getting Data In

How to compare lookup to an index?

Manik_ — Tue, 08 Nov 2022 16:02:10 GMT

Hey all,
Looking for some assistance on this splunk search. I've looked at other examples but for some reason I'm unable to replicate that with our data set.

Currently have:

So what this is doing is matching the Index and lookup file name DataFile by the DNS name and it just gives me the count of what matches and the count of what doesn't have a match in dataFile.

However, I'm looking for this but essentially flipped. I need the results of the lookup table "dataFile" to be the base set of data and compare that to the index named DB so that it displays the count of assets not matched in the index.

I've tried something like this:

but no it just keeps parsing so something is wrong here. Not sure what may be the best approach here.

Re: Comparing lookup to an index

bowesmana — Mon, 07 Nov 2022 23:19:18 GMT

Use this

What you are doing is searching the index data, marking those as finds_in_index (isIx) and then appending the lookup file and marking them as not index finds.

Then join them together and those with isIx set to 1 were index finds, the others not.

Re: Comparing lookup to an index

Manik_ — Tue, 08 Nov 2022 21:32:36 GMT

Thank you, this was great!

All I did was add a where clause for the inputlookup and it worked great to compare and filter by column

|inputlookup dataFile where hostname="*aws.amazon.com*" | fields hostname

Re: Comparing lookup to an index

bowesmana — Tue, 08 Nov 2022 23:44:25 GMT

If the question is solved, please accept the solution so others can benefit