topic Re: How can I extract a field using "lookup" and a .csv file that doesn't pair to an event? in Splunk Search

How can I extract a field using "lookup" and a .csv file that doesn't pair to an event?

mdennisAPFCU — Wed, 24 Jun 2015 18:30:10 GMT

I'm trying to match event data with preset limits recorded in a .csv file.

My search looks for a host and its percentage usage of disk space. I want to pair it with an arbitrarily set maximum % used that varies by server.
e.g. Host BUMBLEBEE can have 95% disk usage, but ITCHY can only have 90%.

How do I get lookup to pair the maximum usage value from the .csv file to the event data that shows the % disk space used?

This is my search:

index=perfmon source="perfmon:logicaldisk" instance!=_Total instance!=HarddiskVolume1 counter="% Free Space"
|eval "pct_used"=round(100-Value,2)|eval mount=instance
 |eval uniq=host."_".mount|dedup uniq
| stats last("pct_used") AS pct_used by host,mount |lookup disk_thresholds host,mount 
| eval crit_threshold=coalesce(crit_threshold,70) 

| where pct_used > crit_threshold`

Re: How can I extract a field using "lookup" and a .csv file that doesn't pair to an event?

lguinn2 — Wed, 24 Jun 2015 20:14:26 GMT

The logic of your search is fine. A lookup does not have to match an "event" per se, it matches against a field.

The syntax of your lookup command is wrong. It should be

| lookup disk_thresholds host mount OUTPUT crit_threshold

Assuming that you have uploaded a CSV file and setup a lookup named disk_thresholds with the appropriate fields.

Here is a step by step guide to setting up a lookup.

Re: How can I extract a field using "lookup" and a .csv file that doesn't pair to an event?

woodcock — Sat, 18 Jul 2015 05:26:12 GMT

The answer from @lguinn is incorrect; your lookup should work fine but there were a few tweaks that should make your stuff work (better), PROVIDED your lookup table has a field called exactly crit_threshold (it might actually be, for example, crit_threshhold); try this:

index=perfmon source="perfmon:logicaldisk" instance!=_Total instance!=HarddiskVolume1 counter="% Free Space" | eval pct_used=round(100-Value,2) | stats last(pct_used) AS pct_used BY host instance | lookup disk_thresholds host mount AS instance | eval crit_threshold=coalesce(crit_threshold,70) | where pct_used > crit_threshold