topic Re: Help on basic question concerning lookup command in Splunk Search

Help on basic question concerning lookup command

jip31 — Tue, 22 Dec 2020 14:12:56 GMT

Hello

I have a stranfge behavior concerning the search below

In the "host_allIND.csv" file, I have just HOSTNAME from a specific type which is "Type 1"

But when I run the search below, I have also HOSTNAME with type = "Type 2"

How is it possible to have events with HOSTNAME= Type 2 even if in "host_allIND.csv" lookup I have only HOSTNAME=Type 1?

`boot` | fields host BootTime | lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY | stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

Thanks

Re: Help on basic question concerning lookup command

aasabatini — Tue, 22 Dec 2020 14:26:51 GMT

Hi,

Please can you explain better what you mean with type 1 or type 2?

anyway you can try to modify the lookup or use a subsearch to modify the output.

Re: Help on basic question concerning lookup command

richgalloway — Tue, 22 Dec 2020 14:27:22 GMT

We don't know what the boot macro does, but nothing else in the query limits the results to a particular host. The lookup command adds three fields, but does not filter the results. If "Type 2" is not in the lookup file then the SITE, DEPARTMENT, and CATEGORY fields will be null.

To filter out the "Type 1" hosts, use a where command or put the desired host into the base query.

`boot` host="Type 2" | fields host BootTime | lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY | stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

Re: Help on basic question concerning lookup command

jip31 — Tue, 22 Dec 2020 14:46:47 GMT

thanks but I thought that in so far as I stats my events with "by host", it just reuses the host existing in my CSV file.....