topic Re: lookup csv file in Splunk Search

lookup csv file

kacel — Tue, 02 Jul 2019 09:55:29 GMT

good morning ,
i have some issues on splunk now if some one can help me ;
the is a discription of my csv :

|Hostname |VersionSoftware | Parent |
|V1 |xxxx |c1 |
|V2 |xxxx |c2 |
|V3 |xxxx |T3 |
|V4 |xxxx |V1 |

so what i want to do is to ignore the line where Hostname == Parent and only from the side of Hostname what i mean is it can be a lot of values equal to V1 on Parent .but in hostname its apear one time
thank all.

Re: lookup csv file

jkat54 — Tue, 02 Jul 2019 12:13:35 GMT

| inputlookup yourlookup.csv
| where hostname!=parent

Re: lookup csv file

kacel — Tue, 02 Jul 2019 12:44:55 GMT

thank you for answer,
but your proposition doesnt work .
i had false result
i think that i must use a loop fixing hostname and iterating on parent .
thanks if u have something-eles

Re: lookup csv file

Richfez — Tue, 02 Jul 2019 12:56:31 GMT

@kacel, Please be careful to "Add comment" when replying to a particular answer instead of "Post Your Answer To This Question". I moved this comment to where it belongs for you.

Unless of course you found your own answer and are helping everyone else by writing it down here!

Anyway - no worries, it's not a big deal, just something to be careful of!

Happy Splunking,
Rich

Re: lookup csv file

Richfez — Tue, 02 Jul 2019 12:58:39 GMT

If those are exactly right example, then case matters!

Working off this more or less perfect answer...

| inputlookup yourlookup.csv
| where Hostname!=Parent

give that a try!

If it doesn't work, please provide what it DOES give you back, and where it's wrong. And what you wanted instead.

Happy Splunking!
Rich

Re: lookup csv file

kacel — Wed, 03 Jul 2019 09:03:37 GMT

i want to compare all values on colum Parent with Hostname values
and if there is an equal then ignore the first line and not all lines so in esult
|Hostname |VersionSoftware | Parent |
|V1 |xxxx |c1 |
|V2 |xxxx |c2 |
|V3 |xxxx |T3 |
|V4 |xxxx |V1 |
|V5 |xxxx |V1 |

target
|Hostname |VersionSoftware | Parent |
|V2 |xxxx |c2 |
|V3 |xxxx |T3 |
|V4 |xxxx |V1 |
|V5 |xxxx |V1 |

Re: lookup csv file

renjith_nair — Wed, 03 Jul 2019 12:53:39 GMT

@kacel,

Are you looking for something similar ?

    | inputlookup your_lookup.csv
    | eventstats values(Parent) as _tmp
    | eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)  | where found!=1

Re: lookup csv file

sandeepmakkena — Wed, 30 Sep 2020 01:14:08 GMT

This gives what you are looking for.