topic Re: How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C? in Splunk Search

How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C?

pavanae — Wed, 14 Mar 2018 21:29:58 GMT

I have a lookup file which contains a list of hostnames under the field Host like below

Host
abd
addf
fdfs

Now how can I get the field values for those hosts in lookup from splunk for A,B and C like below

Host A B C

I am trying to find a simplified way if there is any in splunk instead of searching manually in splunk like below for each host

Host="chdg" OR Host="jkhgsdjh"........ | stats values (A), values(B), values(C) by Host

Re: How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C?

niketn — Wed, 14 Mar 2018 22:03:22 GMT

@pavanae, you might have to add more details on what you need. Whether you do not want to write the Host names in base search or fields names in stats functions? Try the following and confirm:

<your_base_search_with_index_and_sourcetype> [| inputlookup <yourCSVFile>.csv | table Host]
| stats values(*) as * by Host

Please add more details also the context of what field names are and their corresponding value.

Re: How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C?

jkat54 — Thu, 15 Mar 2018 01:43:14 GMT

Is this what you’re looking for?

[| inputlookup hosts.csv host as Host | fields host | format ] | stats values(a) by host

Re: How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C?

pavanae — Thu, 15 Mar 2018 13:52:23 GMT

Yes. Thank you. Although there is a small type on the query and corrected below :-