https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702986#M238310 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/273282">@PotatoDataUser</a>&nbsp;,</P><P>try using the lookup command (<A href="https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup</A>)</P><LI-CODE lang="markup">| tstats count where index=my_index by host | lookup my_lookup.csv server_name</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 29 Oct 2024 10:24:18 GMT gcusello 2024-10-29T10:24:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702975#M238306 <P>So I have a lookup file with a complete list of servers and their details like version, owner etc, and an index my_index that gets logs from servers.<BR /><BR />This is the search I am using right now<BR /><BR /></P> <LI-CODE lang="markup">| inputlookup my_lookup.csv | join type=left server_name [ | tstats count where index=my_index by host | eval reporting="yes"] | eval reporting=if(isnull(reporting),"No","Yes")</LI-CODE> <P><BR />I want to validate the list by referencing it against the tstats reports and show the whole list of the lookupfile.<BR /><BR />What I want to know is if this search is accurate, will the subsearch truncate results giving me inaccurate output, is there any alternate way to write this search, Please help.</P> Tue, 29 Oct 2024 14:13:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702975#M238306 PotatoDataUser 2024-10-29T14:13:06Z https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702986#M238310 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/273282">@PotatoDataUser</a>&nbsp;,</P><P>try using the lookup command (<A href="https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup</A>)</P><LI-CODE lang="markup">| tstats count where index=my_index by host | lookup my_lookup.csv server_name</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 29 Oct 2024 10:24:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702986#M238310 gcusello 2024-10-29T10:24:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702992#M238316 <PRE>| tstats ...<BR />| inputlookup append=t ...<BR />| stats values(*) as * by host</PRE><P>&nbsp;</P> Tue, 29 Oct 2024 11:15:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-join-an-inputlookup-and-a-tstats-search/m-p/702992#M238316 PickleRick 2024-10-29T11:15:58Z