Splunk Dev

How to use a csv inputlookup list of hosts to limit the results of my search?

Earenhart
Path Finder

Hello all,

I am trying to use an inputlookup.csv (it is just a simple list of hosts, nothing more, first cell in .csv is "FQDN") file to limit the results of my search to only those hosts listed in that file. The search is intended to take that list and compare it to the logs to find those that match the "state" of disposed/retired.

| inputlookup HostList.csv | append [search sourcetype=hpsm_connectit_device2m1dst state=disposed/retired] | stats count by fqdn | dedup fqdn

Thanks in advance for any assistance with this.

Tags (1)
0 Karma

starcher
SplunkTrust
SplunkTrust

As Rich said make sure your csv field is called host and is in same format as host values in your search. The best lookup filter pattern is below. Don’t do a dedup in same field in a by in stats. It’s wasted cycles.

sourcetype=hpsm_connectit_device2m1dst state=disposed/retired | lookup HostList.csv host OUTPUT host as isFound | where isnotnull(isFound)| stats count by fqdn

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch. Here is an untested example.

sourcetype=hpsm_connectit_device2m1dst state=disposed/retired [|inputlookup HostList.csv | fields fqdn | format] | stats count by fqdn

Note that dedup is not needed because the by clause of stats removes duplicates.

---
If this reply helps you, Karma would be appreciated.

Earenhart
Path Finder

Unfortunately, that didn't give any results. I have played around with many different configurations, but even when I do get results, there are still plenty that are not in the file (must be pulling them from the logs; not what I want). Is there any way to tell splunk to specifically NOT pull certain data from one source (in this case I have 2 "sources", the inputlookup, and the logs), or to ONLY pull data from them?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I added a format command to my answer. It should help. Make sure the field name in your lookup file matches the field name in your index. If it doesn't, add a rename command to the subsearch.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...