topic Re: Lookup table question in Splunk Search

Lookup table question

pitshot — Wed, 04 Jun 2014 18:42:21 GMT

Using Splunk v 5.04

I have a lookup table containing devicename,interfacename,speed . Each device name can have multiple interfaces associated with it. What I am trying to do is count the interfaces associated to a particular devicename.

|inputlookup LUTOPO | search DEVICENAME="rr1.yyz3*" AND SPEED>=10000000000 | stats count(INTERFACENAME) as count | table DEVICENAME count

The search returns a count of the interfaces but does not show the devicename in the table.

Re: Lookup table question

MarioM — Wed, 04 Jun 2014 19:04:21 GMT

because you need a split by in your stats:

| stats count(INTERFACENAME) as count by DEVICENAME

Re: Lookup table question

pitshot — Wed, 04 Jun 2014 20:02:53 GMT

Perfect, Thanks

Re: Lookup table question

piebob — Wed, 04 Jun 2014 20:09:11 GMT

pitshot, in the future, if another community member's answer solves your problem, please check the checkmark next to it to accept the answer. thanks!