topic Log file validation based on serverhost and source in Splunk Search

Log file validation based on serverhost and source

ganeshkumarmoha — Mon, 10 Jun 2024 12:20:01 GMT

Hi Team,
For a business requirement, I need to validate log file generated for last an hour with combination of host and source in below order:

Host	Source
server001	c\:...\logpath1.txt
server002	c\:...\logpath2.txt
server003	c\:...\logpath3.txt
server004	c\:...\logpath4.txt
server005	c\:...\logpath5.txt

I knew, inputlookup keyword is single column based; however, I need it two columns to check the log file. Can you please suggest what is the best to accomplish my requirement?

Thanks in advance!

Re: Log file validation based on serverhost and source

gcusello — Mon, 10 Jun 2024 12:54:43 GMT

Hi @ganeshkumarmoha

I suppose that you need to check if you' received events from each host with that source, is it correct?

if this is your requirement and if the source column has a fixed part that you can use for checking (e.g. the file name without path), please tru something like this:

Ciao.

Giuseppe

Re: Log file validation based on serverhost and source

gcusello — Thu, 13 Jun 2024 11:41:59 GMT

Hi @ganeshkumarmoha ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉