Archive

compare output of a search to a lookup file

aalaa
Path Finder

Hello ,

I have a csv lookup file that contains all Oracle services, at the same time I have a search that gives me the active services now, I need to know what the service is missing in the result of search on comparison by the csv files.

Any help please?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
if the field is called "service" both in index and in lookup, try something like this:

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0

In this way you have al the missing services.

If you want to list all the services displayng status, you have to replace the last row with

| eval Status=if(Total=o,"Missing","Present")
| table service Status

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
if the field is called "service" both in index and in lookup, try something like this:

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0

In this way you have al the missing services.

If you want to list all the services displayng status, you have to replace the last row with

| eval Status=if(Total=o,"Missing","Present")
| table service Status

Bye.
Giuseppe

View solution in original post

0 Karma

aalaa
Path Finder

This search return the list of service in the csv file :

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| eval Status=if(Total=o,"Missing","Present")
| table service Status

I want to display the name of service that not actif now

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
to display the list of not active services, you have to use the first choice (the one with | where Total=0 ) because the condition to identify not present services is that these services are in the lookup table (count=0) but not in the index (count>0).
Bye.
Giuseppe

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on