topic Re: Search help ? in Splunk Search

Search help ?

splunker969 — Wed, 16 May 2018 15:07:53 GMT

When Iam trying to run this search its giving me wrong results .Please correct my search. In my csv is having to coumlmns one is host and other H=YES . Thanks

Re: Search help ?

elliotproebstel — Wed, 16 May 2018 15:23:27 GMT

Are you trying to filter the results of the metadata query to only show hosts from your lookup file that contain YES in the H field? If so, give this a shot:

| metadata type=hosts index=* 
| search 
 [| inputlookup watchlist1.csv 
 |search H="YES"
 | rename Host as host
 | fields host ] 
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host 
| sort lastTime 
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount

Re: Search help ?

splunker969 — Wed, 16 May 2018 15:35:56 GMT

Hi ellitproebstel ,

Thanks :)Search is working can you help me to find the fully qualified name for host when i search its giving me host name in short cut .

Re: Search help ?

elliotproebstel — Wed, 16 May 2018 15:50:02 GMT

Do you have the fully qualified name somewhere in your logs or in a lookup?

Re: Search help ?

splunker969 — Wed, 16 May 2018 15:58:51 GMT

logs are having names

Re: Search help ?

splunker969 — Wed, 16 May 2018 16:09:46 GMT

In csv better we need to keep host names as below i got results but in more hosts than csv file .

    host     H
     YY*      YES
      XX*      YES

Re: Search help ?

splunker969 — Wed, 16 May 2018 17:02:35 GMT

Hi Mate,

As we are getting the duplicate results from the csv table and the results are coming with both normal host name and hostname with FQDNS. How do we resolve this and please suggest.

Example:
host
host.com

Thanks.