topic Re: multisearch with a lookup and index? in Splunk Search

multisearch with a lookup and index?

msage — Tue, 03 Aug 2021 18:07:45 GMT

I'm looking to combine data from a lookup file to data from our security server to create a comparison chart between how many alarms we get (security server) and how many of those are acknowledged (lookup file). I figured multisearch was the way to go but I'm getting errors when using it. The search is below. The reason for the eval Date fields are because one column contains dates so I needed to get them in the right order since they were always out. The end goal is a daily chart showing x alarms and y acknowledgements.

Re: multisearch with a lookup and index?

manjunathmeti — Wed, 04 Aug 2021 05:07:31 GMT

hi @msage,

Try this:

index=<provide_index_name> EVDESCR="alarm" | append [ | inputlookup genericlookupname.csv ] | eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y")) | stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index!="<provide_index_name>")) as acknowledgements by Date

Re: multisearch with a lookup and index?

msage — Tue, 10 Aug 2021 21:04:15 GMT

Hey @manjunathmeti ,

I tried this but unfortunately the lookup data always stays at 0.

Re: multisearch with a lookup and index?

manjunathmeti — Wed, 11 Aug 2021 04:22:54 GMT

Does genericlookupname.csv has Date field?

Re: multisearch with a lookup and index?

msage — Wed, 11 Aug 2021 20:48:33 GMT

It does yes

Re: multisearch with a lookup and index?

manjunathmeti — Thu, 12 Aug 2021 04:13:07 GMT

Try this:

index=<provide_index_name> EVDESCR="alarm" | append [ | inputlookup genericlookupname.csv | eval index="mycsvdata" ] | eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y")) | fields index, Date | stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index="mycsvdata")) as acknowledgements by Date

If this reply helps you, a like would be appreciated.