topic Re: Compare index with inputlookup in Splunk Search

Comparing index with inputlookup?

danutmatei — Mon, 13 Mar 2023 13:54:34 GMT

Hi,

I have a policy.csv file with 2 columns:

user tags

Andre IT

Kleo Management

Vlad Finance

And I also have an index=events with events and field "user"

What I want is to count the number of events for each tag by user.

for example:

User Tags Count

Andre IT 55

I've tried this, but it counts the number of rows from the csv, not from index:

|inputlookup policy.csv | join type=left tags [|tstats count where index=events by user] |stats count by user tags

Re: Compare index with inputlookup

ITWhisperer — Mon, 13 Mar 2023 11:31:18 GMT

Would this work for you?

|tstats count where index=events by user | lookup policy.csv

Re: Compare index with inputlookup

danutmatei — Mon, 13 Mar 2023 11:51:19 GMT

Re: Compare index with inputlookup

ITWhisperer — Mon, 13 Mar 2023 12:20:50 GMT

In what way does it not work? What else can you tell us about your data which might help us suggest a more meaningful solution?

Re: Compare index with inputlookup

danutmatei — Mon, 13 Mar 2023 12:29:35 GMT

Error in 'lookup' command: Must specify one or more lookup fields.

Re: Compare index with inputlookup

ITWhisperer — Mon, 13 Mar 2023 12:37:02 GMT

Sorry, try it this way

|tstats count where index=events by user | lookup policy.csv user

Re: Compare index with inputlookup

danutmatei — Mon, 13 Mar 2023 12:43:30 GMT

bot working, I get 0 statistics

Re: Compare index with inputlookup

ITWhisperer — Mon, 13 Mar 2023 13:00:09 GMT

What is your current search?

Re: Compare index with inputlookup

danutmatei — Mon, 13 Mar 2023 13:04:51 GMT

|tstats count where index=events by user
| lookup policy.csv user

Re: Compare index with inputlookup

ITWhisperer — Mon, 13 Mar 2023 13:07:33 GMT

Does this return any results?

|tstats count where index=events by user

If not, how about this

index=events | stats count by user

Re: Compare index with inputlookup

danutmatei — Mon, 13 Mar 2023 13:13:34 GMT

And what should I do with this query ? since is not solving my issue and the lookup file is not included ?!

Re: Compare index with inputlookup

ITWhisperer — Mon, 13 Mar 2023 13:16:49 GMT

If you are not getting any results from the tstats or the stats, then the lookup isn't going to make any difference. You need to look at why there are no results. Perhaps the fields don't exist or are spelt differently, including differences in upper and lower case.