https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186269#M53654 <P>Try something like this</P> <PRE><CODE>{blablabla} | stats dc(host) as by ApplicationName, Version | eval ServerCountLookup=[ | inputlookup lookup table | search Destination="PROD" | stats count(host) as count | return $count] | your comparison here... </CODE></PRE> Wed, 26 Aug 2015 16:57:32 GMT somesoni2 2015-08-26T16:57:32Z https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186268#M53653 <P>So I have a search which pulls the number of servers in a farm that have the "X" application installed on them. Now I have a csv file I do a lookup into, which keeps the server status (Production/Testing/etc).</P> <P>What I did was:<BR /> - to get from the main search a result which counts the number of servers where it is installed<BR /> - it displays Application Name | count of servers which have it installed</P> <P>What I want to do now is to count the number of results from within a lookup and compare the results described above in the main search with this result, if there are differences, I woul like to keep from the main search only the applications which are not installed on the same <BR /> number of servers as the inputlookup results.</P> <P>SO:<BR /> Main search:</P> <PRE><CODE>{blablabla} | stats dc(host) by ApplicationName, Version </CODE></PRE> <P>Subsearch would be: </P> <PRE><CODE>| inputlookup *lookup table* | search Destination=*"PROD"* | stats count(host) </CODE></PRE> <P>(which in this particular case returns 89)<BR /> And I need to compare the number of servers which have the same ApplicationName on them with 89 resulted above</P> <P>Any help is highly appreciated</P> Wed, 26 Aug 2015 13:06:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186268#M53653 sergiupopescu 2015-08-26T13:06:43Z https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186269#M53654 <P>Try something like this</P> <PRE><CODE>{blablabla} | stats dc(host) as by ApplicationName, Version | eval ServerCountLookup=[ | inputlookup lookup table | search Destination="PROD" | stats count(host) as count | return $count] | your comparison here... </CODE></PRE> Wed, 26 Aug 2015 16:57:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186269#M53654 somesoni2 2015-08-26T16:57:32Z https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186270#M53655 <P>Works perfect, thank you!</P> Thu, 27 Aug 2015 09:46:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-inputlookup-count-of-results-as-a-filter-for-the-main/m-p/186270#M53655 sergiupopescu 2015-08-27T09:46:10Z