topic Using a value from a lookup table in Splunk Search

Using a value from a lookup table

jravida — Mon, 28 Sep 2020 16:56:27 GMT

Hi folks,

I have a lookup table I created that is derived from a saved search, and it counts the computers on the network each day. It is only a single line with the host count (host_count) and the time (search_time) it was done. I want to use that value in an equation, but I am having a hard time invoking it.

I want it to look like:
|stats count by patched_host | eval percent = (1-((host_count - count)/host_count))
So this would show me the percent of hosts patched.

So my question is how to reference the lookup table that only has two values, host_count and time.

Re: Using a value from a lookup table

somesoni2 — Thu, 26 Jun 2014 19:30:40 GMT

Try something like this

your base search  |stats count by patched_host | eval host_count=[|inputlookup dailyhosts.csv | return $host_count]| eval percent = (1-((host_count - count)/host_count))  | fields - host_count

Re: Using a value from a lookup table

jravida — Thu, 26 Jun 2014 20:11:18 GMT

You are a Splunk god. I gave you credit to my boss so he doesn't start thinking I'm smart.