topic Re: help on subsearch in Splunk Search

How to match the host in host.csv with the field in test.csv?

jip31 — Fri, 24 Jul 2020 22:42:25 GMT

I need tio match the host there is in host.csv with the field there is in test.csv but i dont succeed

could you help me please?

[| inputlookup host.csv | table host ] | lookup test.csv HOSTNAME as host output SITE STATUS | stats values(SITE) as SITE, values(STATUS) as STATUS by host

Re: help on subsearch

gcusello — Fri, 24 Jul 2020 11:49:52 GMT

Hi @jip31,

did you tried something like this?

| inputlookup host.csv | lookup test.csv HOSTNAME as host output SITE STATUS | stats values(SITE) as SITE values(STATUS) as STATUS by host

Ciao.

Giuseppe

Re: help on subsearch

jip31 — Fri, 24 Jul 2020 18:31:07 GMT

Yes but it doesnt work....

Re: help on subsearch

to4kawa — Fri, 24 Jul 2020 18:48:33 GMT

sample:

@gcusello 's query is good. you should display both csv details and the result.

> it doesn't work
What does it display? Have you check the result before stats?

No one can see your screen but you.

Re: help on subsearch

jip31 — Sat, 25 Jul 2020 03:05:12 GMT

Hi to4kawa

Yes the query works but.....

Du to the fact that there is no subsearch with | inputlookup host.csv, the host displayed in my table dont match the host with the host there is in host.csv.....

I need to display the results only for the host in host.csv.......

Re: help on subsearch

jip31 — Mon, 27 Jul 2020 04:15:23 GMT

I have done this

| inputlookup host.csv | join host [| inputlookup test.csv | rename HOSTNAME as host] | stats last(DNS_NAME) as DNS, last(CLIENT_USER) as Client, last(STATUS) as Status, last(DESCRIPTION_MODEL) as Model, last(OS) as OS, last(OS_VERSION) as "OS Version" last(SITE) as Site last(BUILDING_CODE) as Building by host

Re: help on subsearch

spitchika — Mon, 27 Jul 2020 15:43:44 GMT

While joining 2 queries... try to use join type as inner.

"| join type=inner"