topic Re: Search to find missing data using lookup table with multiple fields in Splunk Search

Search to find missing data using lookup table with multiple fields

GersonGarcia — Wed, 09 Mar 2016 00:05:34 GMT

Hello,

I am trying to find missing data in Splunk from a lookup table using inputlookup. My lookup table is:

netdevices_new
netdevice,ip,type
host1,10.10.10.1,router
host2,10.10.10.2,router
host3,10.10.10.3,firewall
host4,10.10.10.4,switch

If I run these searches they work just fine:

For hostnames:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | dedup netdevice | fields netdevice ]

For IPs:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | dedup ip | fields ip ]

How can I search for both netdevice and ip at the same time?

The events in in the network index can have both hostname and ips.

Thank you,

Gerson Garcia

Re: Search to find missing data using lookup table with multiple fields

vasanthmss — Tue, 29 Sep 2020 09:01:18 GMT

Try this

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | stats c by netdevice, ip | fields - c ]

If you don't have both fields ip netdevice change your rex accordingly. Idea here is you need to pass both the field combination to search.

If your lookup doesn't have all the possible combination you need to write another subsearch

Re: Search to find missing data using lookup table with multiple fields

GersonGarcia — Tue, 29 Sep 2020 09:00:33 GMT

When I run:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P< c >[^ ]+)" | stats c by netdevice, ip | fields - c ]

The output is all hosts in the lookup file.

I think this is what you meant since the < c > after ?P was truncated.

Thank you,

Re: Search to find missing data using lookup table with multiple fields

chimell — Wed, 09 Mar 2016 08:07:39 GMT

HI
try this search code

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" |stats count by  ip netdevice| dedup ip netdevice | fields ip netdevice ]