https://community.splunk.com/t5/Splunk-Search/How-can-I-enrich-my-search-results-with-an-inputlookup/m-p/164566#M46723 <P>I'm having a really hard time figuring this one out. How can I enrich my search results with an inputlookup?</P> <P>In this search I can show all hosts that do have a filesystem for a specific process, but don't have that process running:</P> <PRE><CODE>index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host </CODE></PRE> <P>I also created an outputlookup (cpu.csv), showing 3 fields: host, cpu-count, and cpu-type. </P> <P>Now, I would really like to enrich the first search, with the specs from the cpu's, resulting in host (from first search), cpu-count and cpu-type (from inputlookup). </P> <P>Thank you in advance!</P> Wed, 15 Oct 2014 21:29:22 GMT renems 2014-10-15T21:29:22Z https://community.splunk.com/t5/Splunk-Search/How-can-I-enrich-my-search-results-with-an-inputlookup/m-p/164566#M46723 <P>I'm having a really hard time figuring this one out. How can I enrich my search results with an inputlookup?</P> <P>In this search I can show all hosts that do have a filesystem for a specific process, but don't have that process running:</P> <PRE><CODE>index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host </CODE></PRE> <P>I also created an outputlookup (cpu.csv), showing 3 fields: host, cpu-count, and cpu-type. </P> <P>Now, I would really like to enrich the first search, with the specs from the cpu's, resulting in host (from first search), cpu-count and cpu-type (from inputlookup). </P> <P>Thank you in advance!</P> Wed, 15 Oct 2014 21:29:22 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-enrich-my-search-results-with-an-inputlookup/m-p/164566#M46723 renems 2014-10-15T21:29:22Z https://community.splunk.com/t5/Splunk-Search/How-can-I-enrich-my-search-results-with-an-inputlookup/m-p/164567#M46724 <P>Try this</P> <PRE><CODE> index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host | lookup cpu.csv host </CODE></PRE> <P>Assuming cpu.csv is set as lookup table and its scope/permissions have been setup correctly to be accessible here.</P> Wed, 15 Oct 2014 22:04:14 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-enrich-my-search-results-with-an-inputlookup/m-p/164567#M46724 somesoni2 2014-10-15T22:04:14Z