Archive

How to use a csv inputlookup list of hosts to limit the results of my search?

Explorer

Hello all,

I am trying to use an inputlookup.csv (it is just a simple list of hosts, nothing more, first cell in .csv is "FQDN") file to limit the results of my search to only those hosts listed in that file. The search is intended to take that list and compare it to the logs to find those that match the "state" of disposed/retired.

| inputlookup HostList.csv | append [search sourcetype=hpsm_connectit_device2m1dst state=disposed/retired] | stats count by fqdn | dedup fqdn

Thanks in advance for any assistance with this.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

As Rich said make sure your csv field is called host and is in same format as host values in your search. The best lookup filter pattern is below. Don’t do a dedup in same field in a by in stats. It’s wasted cycles.

sourcetype=hpsm_connectit_device2m1dst state=disposed/retired | lookup HostList.csv host OUTPUT host as isFound | where isnotnull(isFound)| stats count by fqdn

0 Karma

SplunkTrust
SplunkTrust

Try a subsearch. Here is an untested example.

sourcetype=hpsm_connectit_device2m1dst state=disposed/retired [|inputlookup HostList.csv | fields fqdn | format] | stats count by fqdn

Note that dedup is not needed because the by clause of stats removes duplicates.

---
If this reply helps you, an upvote would be appreciated.

Explorer

Unfortunately, that didn't give any results. I have played around with many different configurations, but even when I do get results, there are still plenty that are not in the file (must be pulling them from the logs; not what I want). Is there any way to tell splunk to specifically NOT pull certain data from one source (in this case I have 2 "sources", the inputlookup, and the logs), or to ONLY pull data from them?

0 Karma

SplunkTrust
SplunkTrust

I added a format command to my answer. It should help. Make sure the field name in your lookup file matches the field name in your index. If it doesn't, add a rename command to the subsearch.

---
If this reply helps you, an upvote would be appreciated.
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!