topic Re: tstats and inputlookup case sensitive problem in Splunk Search

tstats and inputlookup case sensitive problem

splunkreal — Fri, 09 Mar 2018 15:21:09 GMT

We had problem this week with logs indexed with lower or upper case hostnames. We run this query in a scheduled macro :

It seems that our eval functions don't do the job.

Query attached.

Thanks.

link text

Re: tstats and inputlookup case sensitive problem

somesoni2 — Fri, 09 Mar 2018 16:26:56 GMT

Assuming your lookup table has host names in lower case, but indexed data has various case, try this

| tstats latest(_time) as latest,earliest(_time) as earliest WHERE index = * by host source | eval host=lower(host) | search [| inputlookup liste_serv |  eval host = host+"*"  | eval source=split(logsSystem, "#") | mvexpand source | table host source] | eval host = lower(replace(host,".production.com","")) | eval timeNow=relative_time( now(), "-8h@h") | where latest<timeNow | eval last=strftime(latest, "%Y-%m-%d %T") | eval first=strftime(earliest, "%Y-%m-%d %T") | sort - last | stats list(source) as source list(last) as "lastApparition" list(latest) as latest list(count) as count by host

Re: tstats and inputlookup case sensitive problem

splunkreal — Fri, 09 Mar 2018 16:40:30 GMT

Thanks somesoni2 however we already tried it by adding | eval host=lower(host) before inputlookup 😞

Re: tstats and inputlookup case sensitive problem

splunkreal — Mon, 12 Mar 2018 17:05:30 GMT

The problem is with tstats which is case sensitive, I haven't problem with stats but it's very slow.

Re: tstats and inputlookup case sensitive problem

splunkreal — Mon, 12 Mar 2018 17:44:12 GMT

Solved by adding after tstats :

| eval host = lower(host) | stats max(latest) as latest,min(earliest) as earliest by host source