Splunk Enterprise 7x
I am basically trying to get this to work:
https://answers.splunk.com/answers/519950/ho-to-get-search-input-from-csv-file.html
I have created a .csv, inported it, and created a lookup definition. I am trying to filter the results of a "*" search for service status such that it only displays the services listed in the .csv.
eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName] | dedup host, Name | table host, Name, Startmode, State
This query is from the Windows App. It works just fine when the lookup section isn't included.
Can someone tell me what I am doing wrong?
Thank you,
Ron Jones
You are missing format
eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName| format] | dedup host, Name | table host, Name, Startmode, State
You are missing format
eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName| format] | dedup host, Name | table host, Name, Startmode, State
I can see why FORMAT needs to b there, but it is still not working. My CSV is just list of services, I am now reading that it requires two fields. Any recomendation what I should put in the other field?
Thank you for the help.
What's the field name in your base search that corresponds to the CSV field "ServiceName" ? Is it "ServiceName" OR "Name"? If it's name, include a rename command in your subsearch.
I added renme ServiceName as Name after format and still no results. Current search:
eventtype=hostmon_winows Type=Service host="SCCM" (Name="") Startmode="" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName| format| rename Servicenam as Name] | dedup host, Name | table host, Name, Startmode, State
You need to have the format after rename. You need a rename when the fieldname is lookup is different from the index/search.
Got it. It is working, with an issue. The orginal sarch, without the inputlookup, wan't showing all of the services (I missed that.) Now, theresults are only the services that are on "" results AND the .csv. For instance the Server service is not listed under the"" results, is listed on the csv and does not show up in the querry; wudfsvc does apper in the "*" results, is on the csv and shows up in the querrrry results.
Does anyone have anyidea why all the serviceswould not be displayed when the querry uses the * widcard?
Thank you
Totally working pefect now! Turns out, the Display Name is not appropriate. LanManServer popped right up. This is goig to mak mmmy life so much easier as I work through the rest of our systems.
Thank you so much
The rename has to happend before the format command.
eventtype=hostmon_winows Type=Service host="SCCM" (Name="") Startmode="" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName | rename Servicenam as Name| format] | dedup host, Name | table host, Name, Startmode, State
That did it, thank you very much!
If I understandyour question correctly, it is Name. As in the table host, Name, Startmode, State entry. Do I need to rename the CSV field Name?