topic Re: Match lookup field values with Splunk results and display over lookup field value yes/no in Knowledge Management

Match lookup field values with Splunk results and display over lookup field value yes/no

Satheesh_red — Wed, 28 Jun 2023 17:14:48 GMT

Hi,

The lookup field values must match the field values returned by the query, and the results must be shown as yes/no depending on whether the match happens. but we are unable to match and are unable to publish all of the information from the lookup fields in the results. Please assist.

My lookup file:-

Result output:-

18387355 value is missing in the Patch_num output and it should be 'No' in matching_status field as thsi value is not available in the Search result field.

Regards,
Satheesh

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

ITWhisperer — Wed, 28 Jun 2023 20:20:45 GMT

Rather than looking up the patch_num, you could set a field to 2, append the .csv with the same field set to 1, and then sum the field by patch_num using eventstats. Where the sum is 1, the patch_num only exists in the csv.

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

Satheesh_red — Thu, 29 Jun 2023 01:50:12 GMT

Thankyou for your reply @ITWhisperer

Would please share me the sample/reference syntax will be really helpful.

Thankyou for understanding.

Regards

Satheesh

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

ITWhisperer — Thu, 29 Jun 2023 05:25:46 GMT

Try something like this

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

Satheesh_red — Thu, 29 Jun 2023 16:46:44 GMT

Hi @ITWhisperer

While performing more validations, I noticed an issue.

When I put host=* it's not giving accurate results, and if I remove host=* and checking with index=abc and source type=xyz also isn't giving correct results, any reason? The command is operating just fine with just one host every time, meaning each time we have to pass against with one host.

index=abc and source type=xyz host=abc - working fine

index=abc and source type=xyz host=* - not working

index=abc and source type=xyz - not working.

Kindly suggest.

Regards,
Satheesh

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

ITWhisperer — Thu, 29 Jun 2023 21:01:38 GMT

Sounds like an issue with your data. You haven't provided enough detail as to why some hosts are not working.

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

Satheesh_red — Fri, 30 Jun 2023 02:01:42 GMT

My apologies @ITWhisperer

I'm looking for, matching case of Patch_num in the events for each and every host that are existed in lookup list.

Ex:- if lookup list is having 25 patch numbers row list and host A Patch_num resulted 24 in the events and host B resulted 25 in the events and host C resulted 20 events and so on for N number of hosts. The output match case should be with list 25 patches for each host.

Domain_name Host patchlist Match_case

xyz1 ABC Row 1 num in list Yes/no

xyz1 ABC Row 2 number in list Yes/no

xyzN ABC. .....RowN(like this for all the rows in the list,ex 25) Yes/No

xyz2 DEF Row1 num in list Yes/no

xyz2 DEF. Row1. num in list. Yes/no

xyzN DEF. RowN. Yes/No

xyz3. GHI. Row1 num in list. Yes/No

xyz3. GHI. Row2 num in list Yes/No

Like this, Yes/No match case with Patch_num are available in the events for each host.

Each host should be having some list of patch numbers and available in Patch_num events filled.

Hope this explanation helps, please let me know if required additional details.

Thankyou for helping.

Regards,

Satheesh

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

Satheesh_red — Fri, 30 Jun 2023 04:28:49 GMT

Hi @ITWhisperer

I hope below screenshot looks more helpful for you.

Regards,
Satheesh

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

ITWhisperer — Sat, 01 Jul 2023 07:37:03 GMT

Re: Match lookup field values with Splunk results and display over lookup field value yes/no

Satheesh_red — Sun, 02 Jul 2023 07:19:51 GMT

Thankyou @ITWhisperer , it's working as expected. Appreciated your time and support

Regards

Satheesh