Question about lookups

nebel — Sun, 02 Dec 2012 15:54:17 GMT

Hi,

hopefully someone can give me an advise.

On the one hand I am having a lookup file which contains only simple server names, for instance

Server A
Server B
Server C

From some of them I am having logs, from some of them not. The goal is to create a table which contains all my servers in the lookup file. And then I want to have a another field which contains informations about how often I've got logs from them servers.

Server A   116 Events 
Server B   690 Events
Server C   0 Events

How can I realise this? I only want to see servers from my lookup file, and I also want to see if the server sends zero events.

Thank you very much

Regards

Re: Question about lookups

lguinn2 — Sun, 02 Dec 2012 20:32:53 GMT

Try this

| inputlookup myserverlookup
| join type=outer host 
    [ search index=_internal sourcetype=splunkd source=*metrics* "group=per_host_thruput"  earliest=-24h
    | stats sum(ev) as events by series 
    | fields - host 
    | rename series as host ]
| join type=outer host [ | metadata type=hosts index=* | fields host lastTime ] 
| fieldformat lastTime = strftime(lastTime,"%x %X") 
| fieldformat events = tostring(events,"commas")
| sort host
| fields host events lastTime

This assumes that your lookup is called myserverlookup and that the field name in the associated csv is host.

This search tries to do things efficiently - instead of looking at all the indexes and counting up all the events - which would take a long time - it uses Splunk's internal metrics to count the events and the last time an event arrived from each host.

topic Re: Question about lookups in Splunk Search

Question about lookups

Re: Question about lookups