https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558188#M158546 <P>Rename ComputerName to host so it matches the name in the csv, then count how many times each host appear. It will be 2 if there are events in the index and the csv</P><LI-CODE lang="markup">index=main |stats count by ComputerName | rename ComputerName as host | inputlookup append=t hostinventory.csv | stats count by host</LI-CODE> Fri, 02 Jul 2021 17:46:05 GMT ITWhisperer 2021-07-02T17:46:05Z https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558184#M158543 <P>Hello,</P><P>It is the first time that I am going to use this command and the truth is I am a bit confused even though I have read about this command but the truth is not clear to me.</P><P>I have windows machines with the agent installed sending logs to index = main</P><P>I have a file in .csv with the inventory of all the machines</P><P>I need to get a list of the hosts that have never reported logs, either because the agent has not been installed yet or because I report logs and at a certain point I stop doing it</P><P>I installed the "lookup Editor" and already uploaded the inventory there.</P><P>Using the query | inputlookup hostinventory.csv I already get inventory information</P><P>But I need to make a comparison of the hosts that the index = main sees that report or have reported logs vs the inventory csv file to get an idea of ​​which hosts are reporting and which ones are not.<BR /><BR />in the host inventory file I have a column called "host" I need to buy it with the "host" field from the index main.<BR /><BR />index=main |stats count by ComputerName&nbsp; (brings me the hosts that are reporting logs from the index main)<BR /><BR />| inputlookup hostinventory.csv (brings me the logs that are in the csv file in the field called "host")</P><P>but I cannot correlate the two sources of information to get a list of which hosts are reporting and which are not reporting logs</P> Fri, 02 Jul 2021 16:40:48 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558184#M158543 splunkcol 2021-07-02T16:40:48Z https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558188#M158546 <P>Rename ComputerName to host so it matches the name in the csv, then count how many times each host appear. It will be 2 if there are events in the index and the csv</P><LI-CODE lang="markup">index=main |stats count by ComputerName | rename ComputerName as host | inputlookup append=t hostinventory.csv | stats count by host</LI-CODE> Fri, 02 Jul 2021 17:46:05 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558188#M158546 ITWhisperer 2021-07-02T17:46:05Z https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558209#M158552 <P>Thank you very much for your valuable help.</P><P>I have added a <STRONG>where count = 2</STRONG> for those who are reporting logs and <STRONG>where count = 1</STRONG> for those who are not reporting logs</P> Fri, 02 Jul 2021 20:34:30 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-help/m-p/558209#M158552 splunkcol 2021-07-02T20:34:30Z