Getting Data In
Highlighted

In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

New Member

Splunk Enterprise 7x

I am basically trying to get this to work:

https://answers.splunk.com/answers/519950/ho-to-get-search-input-from-csv-file.html

I have created a .csv, inported it, and created a lookup definition. I am trying to filter the results of a "*" search for service status such that it only displays the services listed in the .csv.

eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv   |fields ServiceName] | dedup host, Name | table host, Name, Startmode, State

This query is from the Windows App. It works just fine when the lookup section isn't included.

Can someone tell me what I am doing wrong?

Thank you,

Ron Jones

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

SplunkTrust
SplunkTrust

You are missing format

eventtype=hostmon_winows Type=Service host="SCCM" (Name="*") Startmode="*" State= "*" [ |inputlookup SCCMServicesCSV.csv   |fields ServiceName| format] | dedup host, Name | table host, Name, Startmode, State

View solution in original post

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

New Member

I can see why FORMAT needs to b there, but it is still not working. My CSV is just list of services, I am now reading that it requires two fields. Any recomendation what I should put in the other field?
Thank you for the help.

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

SplunkTrust
SplunkTrust

What's the field name in your base search that corresponds to the CSV field "ServiceName" ? Is it "ServiceName" OR "Name"? If it's name, include a rename command in your subsearch.

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

New Member

If I understandyour question correctly, it is Name. As in the table host, Name, Startmode, State entry. Do I need to rename the CSV field Name?

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

New Member

I added renme ServiceName as Name after format and still no results. Current search:
eventtype=hostmon_winows Type=Service host="SCCM" (Name="") Startmode="" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName| format| rename Servicenam as Name] | dedup host, Name | table host, Name, Startmode, State

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

SplunkTrust
SplunkTrust

The rename has to happend before the format command.

eventtype=hostmon_winows Type=Service host="SCCM" (Name="") Startmode="" State= "*" [ |inputlookup SCCMServicesCSV.csv |fields ServiceName | rename Servicenam as Name| format] | dedup host, Name | table host, Name, Startmode, State
0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

New Member

That did it, thank you very much!

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

SplunkTrust
SplunkTrust

You need to have the format after rename. You need a rename when the fieldname is lookup is different from the index/search.

0 Karma
Highlighted

Re: In Splunk Enterprise 7x, how do you get results of a search based on CSV content?

New Member

Got it. It is working, with an issue. The orginal sarch, without the inputlookup, wan't showing all of the services (I missed that.) Now, theresults are only the services that are on "" results AND the .csv. For instance the Server service is not listed under the"" results, is listed on the csv and does not show up in the querry; wudfsvc does apper in the "*" results, is on the csv and shows up in the querrrry results.

Does anyone have anyidea why all the serviceswould not be displayed when the querry uses the * widcard?
Thank you

0 Karma