Splunk Search

Search for hosts in a lookup, but not in Splunk.

JensT
Communicator

Hi,

we have a list of hosts of our inventory. Now we want to find all hosts that are in that list, but are not sending to Splunk.

How can we achieve this?
Splunk 4.3.5

Cheers,

Jens

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi JensT

given your lookup table is like this:

cs_host, cs_description
foohost, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called "cs_lookup.csv", the relevant logs have sourcetype "cs_systemlogs" and that the field "cs_host" exists in those log events. In that case, this search should get you going:

| inputlookup cs_lookup.csv | search NOT [search sourcetype="cs_systemlogs" | dedup cs_host | fields cs_host]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi JensT

given your lookup table is like this:

cs_host, cs_description
foohost, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called "cs_lookup.csv", the relevant logs have sourcetype "cs_systemlogs" and that the field "cs_host" exists in those log events. In that case, this search should get you going:

| inputlookup cs_lookup.csv | search NOT [search sourcetype="cs_systemlogs" | dedup cs_host | fields cs_host]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...