https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370042#M108985 <P>Thank you!!!!</P> Wed, 21 Mar 2018 14:17:39 GMT davidcraven02 2018-03-21T14:17:39Z https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370038#M108981 <P>I'm trying to build a pass/fail check to see if a machine already exists in a csv, as I have a dashboard with a text input where a machine name can be entered.</P> <P>Below is my search which displays all the machines from the csv, combining them into one line. </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4588i935C55B0EF0BA7A8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 21 Mar 2018 11:22:10 GMT https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370038#M108981 davidcraven02 2018-03-21T11:22:10Z https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370039#M108982 <P>try adding something like this:</P> <PRE><CODE>|eval exists=if(like(machine,"%$token$%"),1,0) </CODE></PRE> <P>where the <STRONG>token</STRONG> is the dashboard text input</P> Wed, 21 Mar 2018 12:11:01 GMT https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370039#M108982 cmerriman 2018-03-21T12:11:01Z https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370040#M108983 <P>Thank you for this but how would I add a pass or fail to display this?</P> Wed, 21 Mar 2018 12:19:53 GMT https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370040#M108983 davidcraven02 2018-03-21T12:19:53Z https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370041#M108984 <P>what is your desired output, exactly?</P> <P>do you just want a dashboard panel that says "<STRONG>pass</STRONG>" or "<STRONG>fail</STRONG>"? if so, add <CODE>|eval exists=if(like(machine,"%$token$%"),"pass","fail")|table exists</CODE> and display as a single value, maybe? </P> Wed, 21 Mar 2018 12:36:36 GMT https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370041#M108984 cmerriman 2018-03-21T12:36:36Z https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370042#M108985 <P>Thank you!!!!</P> Wed, 21 Mar 2018 14:17:39 GMT https://community.splunk.com/t5/Splunk-Search/Check-to-compare-value-with-csv-contents/m-p/370042#M108985 davidcraven02 2018-03-21T14:17:39Z