topic Re: Can you help me integrate a lookup into a search? in Splunk Search

Can you help me integrate a lookup into a search?

donemery — Mon, 24 Sep 2018 21:15:34 GMT

I am trying to integrate a lookup into a search with no success. My goal is to run the search, lookup the hostname or TID and compare it to the lookup table (HOSTNAME field) and return results based on matches to the ROLE field. The ROLE column in the lookup that defines whether TID is core, cpe or aggregation. Here is my search:

index=my_main "SFP receive power low  alarm set" 
| stats dc(date_mday) as Days, count by TID, J_Port | eval c_TID=upper(c_TID) 
| where Days > 2 AND count > 49 | appendpipe [stats count | where count=0]
| rename count as "Total Errors", TID as Hostname, J_Port as Port
| sort -"Total Errors"

The lookup table file and definition are working. My difficulty is integrating it into my search.

Re: Can you help me integrate a lookup into a search?

skoelpin — Mon, 24 Sep 2018 21:29:32 GMT

I don't see your lookup in the search. It should follow this format

| lookup filename.csv hostname AS host OUTPUT ROLE

Re: Can you help me integrate a lookup into a search?

donemery — Tue, 25 Sep 2018 15:16:20 GMT

I didn't include it in the search because no matter where I try it, I get an error back when it is executed. Any guidance as to the proper placement of the lookup is appreciated.

Re: Can you help me integrate a lookup into a search?

Vijeta — Tue, 25 Sep 2018 15:26:20 GMT

Place it at the end of the search, and if you still get the error please paste the complete search with lookup and the error message.

Re: Can you help me integrate a lookup into a search?

skoelpin — Tue, 25 Sep 2018 15:30:35 GMT

For performance purposes, its always better to have a stats before the lookup. Place it like this

index=my_main "SFP receive power low  alarm set" 
 | stats dc(date_mday) as Days, count by TID, J_Port | eval c_TID=upper(c_TID) 
| lookup filename.csv hostname AS host OUTPUT ROLE
 | where Days > 2 AND count > 49 | appendpipe [stats count | where count=0]
 | rename count as "Total Errors", TID as Hostname, J_Port as Port
 | sort -"Total Errors"

Re: Can you help me integrate a lookup into a search?

donemery — Wed, 26 Sep 2018 14:56:26 GMT

It's working now. Thanks!