topic Re: Hosts event search by lookup table in Splunk Search

Hosts event search by lookup table

ned692000 — Thu, 05 Aug 2021 08:18:18 GMT

Hi all,

I have created a lookup table and imported it into SPLUNK. It has 2 columns, one called hosts the other called IPs. The columns are populated with the hosts I want to query. I'm very new to SPLUNK and would like to create a search that returns errors/events worth investigating from the hosts specified in the lookup file. I'll display the results on a dashboard and will be checking this daily for preventative maintenance on my system. I'm just after events worth looking in to and need to filter out irrelevant events to save time. Can anyone help? Thanks in advance.

Re: Hosts event search by lookup table

manjunathmeti — Thu, 05 Aug 2021 08:31:20 GMT

hi @ned692000,

You can filter index events using inputlookup in a sub-search like below. This will return the events for the hosts specified in the lookup file

index=indexname sourcetype=sourcetypename [| inputlookup lookup_table | fields hosts | rename hosts as host | format]

If this reply helps you, a like would be appreciated.

Re: Hosts event search by lookup table

ned692000 — Thu, 05 Aug 2021 11:58:21 GMT

Thanks for your reply, that worked and its very useful. I have a further question. Are there any keywords/ event ID's that I can use to filter out events for Linux machines? I have used event ID's for windows but not sure what to use for Linux. Thanks again

Re: Hosts event search by lookup table

isoutamo — Thu, 05 Aug 2021 12:13:46 GMT

In Linux there are not same kind of event ids as Windows have. In Linux there are several logs like syslog which have several different events from several processes/daemons. Depending of your configuration you could have sourcetypes, tags or other keywords which you can use in our queries.
For further help we must know what and how you are collecting those logs and are you using some TA's for that or are you doing tokenisation by yourself.
r. Ismo

Re: Hosts event search by lookup table

ned692000 — Thu, 05 Aug 2021 12:50:18 GMT

Hi,

Thanks for the reply, it's taking everything from var/messages via a forwarder. Is there anything I can use as a filter to reduce UN-useful messages. i.e. things I need to keep an eye on, rather than just normal system events