Getting Data In

In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

noy72
New Member

Splunk Enterprise 7x

I am basically trying to get this to work:

https://answers.splunk.com/answers/519950/ho-to-get-search-input-from-csv-file.html

I have created a .csv, inported it, and created a lookup definition. I am trying to filter the results of a "*" search for service status such that it only displays the services listed in the .csv.

eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv   |fields ServiceName] | dedup host, Name | table host, Name, Startmode, State

This query is from the Windows App. It works just fine when the lookup section isn't included.

Can someone tell me what I am doing wrong?

Thank you,

Ron Jones

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

You are missing format

eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv   |fields ServiceName| format] | dedup host, Name | table host, Name, Startmode, State

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

You are missing format

eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv   |fields ServiceName| format] | dedup host, Name | table host, Name, Startmode, State
0 Karma

noy72
New Member

I can see why FORMAT needs to b there, but it is still not working. My CSV is just list of services, I am now reading that it requires two fields. Any recomendation what I should put in the other field?
Thank you for the help.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's the field name in your base search that corresponds to the CSV field "ServiceName" ? Is it "ServiceName" OR "Name"? If it's name, include a rename command in your subsearch.

0 Karma

noy72
New Member

I added renme ServiceName as Name after format and still no results. Current search:
eventtype=hostmon_winows Type=Service host="SCCM" (Name="") Startmode="" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName| format| rename Servicenam as Name] | dedup host, Name | table host, Name, Startmode, State

0 Karma

lakshman239
SplunkTrust
SplunkTrust

You need to have the format after rename. You need a rename when the fieldname is lookup is different from the index/search.

0 Karma

noy72
New Member

Got it. It is working, with an issue. The orginal sarch, without the inputlookup, wan't showing all of the services (I missed that.) Now, theresults are only the services that are on "" results AND the .csv. For instance the Server service is not listed under the"" results, is listed on the csv and does not show up in the querry; wudfsvc does apper in the "*" results, is on the csv and shows up in the querrrry results.

Does anyone have anyidea why all the serviceswould not be displayed when the querry uses the * widcard?
Thank you

0 Karma

noy72
New Member

Totally working pefect now! Turns out, the Display Name is not appropriate. LanManServer popped right up. This is goig to mak mmmy life so much easier as I work through the rest of our systems.
Thank you so much

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The rename has to happend before the format command.

eventtype=hostmon_winows Type=Service host="SCCM" (Name="") Startmode="" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName | rename Servicenam as Name| format] | dedup host, Name | table host, Name, Startmode, State
0 Karma

noy72
New Member

That did it, thank you very much!

0 Karma

noy72
New Member

If I understandyour question correctly, it is Name. As in the table host, Name, Startmode, State entry. Do I need to rename the CSV field Name?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...