How to use a csv inputlookup list of hosts to limit the results of my search?

[Earenhart]

Hello all,

I am trying to use an inputlookup.csv (it is just a simple list of hosts, nothing more, first cell in .csv is "FQDN") file to limit the results of my search to only those hosts listed in that file. The search is intended to take that list and compare it to the logs to find those that match the "state" of disposed/retired.

| inputlookup HostList.csv | append [search sourcetype=hpsm_connectit_device2m1dst state=disposed/retired] | stats count by fqdn | dedup fqdn

Thanks in advance for any assistance with this.

[starcher]

As Rich said make sure your csv field is called host and is in same format as host values in your search. The best lookup filter pattern is below. Don’t do a dedup in same field in a by in stats. It’s wasted cycles.

sourcetype=hpsm_connectit_device2m1dst state=disposed/retired | lookup HostList.csv host OUTPUT host as isFound | where isnotnull(isFound)| stats count by fqdn

[richgalloway]

Try a subsearch. Here is an untested example.

sourcetype=hpsm_connectit_device2m1dst state=disposed/retired [|inputlookup HostList.csv | fields fqdn | format] | stats count by fqdn

Note that dedup is not needed because the by clause of stats removes duplicates.

[Earenhart]

Unfortunately, that didn't give any results. I have played around with many different configurations, but even when I do get results, there are still plenty that are not in the file (must be pulling them from the logs; not what I want). Is there any way to tell splunk to specifically NOT pull certain data from one source (in this case I have 2 "sources", the inputlookup, and the logs), or to ONLY pull data from them?

[richgalloway]

I added a format command to my answer. It should help. Make sure the field name in your lookup file matches the field name in your index. If it doesn't, add a rename command to the subsearch.