Getting Data In

How to exclude Host using Inputlookup?

karthi2809
Communicator

index=bp_prod NOT ([|inputlookup serverBP.csv|fields Servers Status |where Status=="N"] ) |eventstats count as "totalCount" | eventstats count as "choiceCount" by host| eval percent=(choiceCount/totalCount)*100 | stats values(choiceCount) as Count , values(percent) as Percentage by host

In my serverBP.csv i have following coloumn:

Servers Status

server1 Y
server2 Y
server3 N

I have to exclude server 3 in my query

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Change the subsearch to output only the server name for the servers with status N, and rename the field name to whatever the field will be called on the other index...

[|inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host]

You can see what the output of the implicit format command will be -- that is, what will be returned by the square brackets -- by running the search independently, and piping it to the explicit format command....

 |inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host | format

...which in this case will probably look like...

(host="server3")
0 Karma