Hello ,
i have a csv file that contains the list of all existing services, and i have a search already created that gives the active services now, so i need a search that gives me the name of service not active (missing in search result of active services) ==> so how to compare the csv file contents and the active service result to extract the non-active services ?
Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!
index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0
Bye.
Giuseppe
Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!
index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0
Bye.
Giuseppe
Hi ,
it doesn't work for me , i need another proposition please