topic inputlookup and search results from data in Splunk Search

inputlookup and search results from data

Splunk_rocks — Thu, 13 Jun 2019 01:52:26 GMT

Hello Splunkers,

I have inputlooku test.csv and containing fields host region

I have indexed data under test index containing fields host location status area DC

So what i need take input from look up table field host and search with in indexed data for status .

I was trying below one but not sure this is correct .

index=test status="Down" [| inputlookup test.csv | fields host] | dedup host | table host status DC

any thing is fine either before filter or after filter goal is to just show the results for host which are in my list.

MuS — Thu, 13 Jun 2019 01:56:14 GMT

Hi Splunk_rocks,

try this:

index=test  status="Down"  [| inputlookup test.csv | fields host | format ] | dedup host | table host status DC

By using format the sub search will return a string like this (( host=x ) OR (host=y) OR (host=z)) which then in turn will be used in the search.

Hope this helps ...

cheers, MuS

VatsalJagani — Thu, 13 Jun 2019 14:12:47 GMT

Your query looks correct, just one thing for you to keep in mind if you have very enormous amount of hosts in lookup your query may brake.