topic compare output of a search to a lookup file in Splunk Search

compare output of a search to a lookup file

aalaa — Wed, 02 Oct 2019 11:53:15 GMT

Hello ,

I have a csv lookup file that contains all Oracle services, at the same time I have a search that gives me the active services now, I need to know what the service is missing in the result of search on comparison by the csv files.

Any help please?

Re: compare output of a search to a lookup file

gcusello — Wed, 02 Oct 2019 12:28:33 GMT

Hi aalaa,
if the field is called "service" both in index and in lookup, try something like this:

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0

In this way you have al the missing services.

If you want to list all the services displayng status, you have to replace the last row with

| eval Status=if(Total=o,"Missing","Present")
| table service Status

Bye.
Giuseppe

Re: compare output of a search to a lookup file

aalaa — Wed, 30 Sep 2020 02:22:24 GMT

This search return the list of service in the csv file :

I want to display the name of service that not actif now

Re: compare output of a search to a lookup file

gcusello — Wed, 02 Oct 2019 15:26:44 GMT

Hi aalaa,
to display the list of not active services, you have to use the first choice (the one with | where Total=0 ) because the condition to identify not present services is that these services are in the lookup table (count=0) but not in the index (count>0).
Bye.
Giuseppe