topic Re: Can you help me do an outputlookup with a condition? in Splunk Search

Can you help me do an outputlookup with a condition?

jip31 — Thu, 22 Nov 2018 07:00:24 GMT

Hello

I use the code below.

I'm doing an outputlookup at the end of the query, but I want to do it with a condition.

The condition is that Build=1511.

Do i have to use a where command or there is another solution please??

eventtype="AppliEV" Level=* 
| dedup host 
| stats count by host 
| append 
    [ search index="ai-wkst-windows-fr" sourcetype=WinRegistry key_path="\\registry\\machine\\xx" 
        OR 
        key_path="\\registry\\machine\\xx" 
    | eval OS=if(key_path=="\\registry\\machine\\software\\xx), 
        Build=if(key_path=="\\registry\\machine\\software\\xx) 
    | stats latest(OS) as OS latest(Build) as Build by host ] 
| stats values(OS) as OS values(Build) as Build by host 
| stats count as Total by OS Build host | fields - host | outputlookup build.csv

Re: Can you help me do an outputlookup with a condition?

nryabykh — Tue, 29 Sep 2020 22:06:45 GMT

Hi!

You can use a where command in this way:



 ...

    | stats count as Total by OS Build host 

    | fields - host

    | appendpipe

        [where Build="1511" 

        | outputlookup override_if_empty=f build.csv

        | where nofield="novalue"]

It helps to avoid overriding build.csv with empty file in case of Build is not 1511.

Re: Can you help me do an outputlookup with a condition?

jip31 — Fri, 23 Nov 2018 06:05:16 GMT

many thanks

Re: Can you help me do an outputlookup with a condition?

grittonc — Mon, 08 Apr 2019 12:32:26 GMT

This is awesome! Thank you.