Getting Data In

Inputlookup Exception List not filtering

rykermurdock77
Explorer

I have a report that shows me all "missing" hosts across our network. I have created a lookup file and definition to filter out any systems we have decommissioned (lookupdefname) and any systems that have been found new on our network within the last 30 days.(lookupdefname2). Even though i've followed step by step how to build this search, it isn't filtering like it should. Any help is appreciated:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host "^(?[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname ] NOT
[| inputlookup lookupdefname2
| table fieldname]
| dedup host
| where recentTime

0 Karma
1 Solution

woodcock
Esteemed Legend

This has been solved many times including:
Meta Woot!: https://splunkbase.splunk.com/app/2949/
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

In any case, try this:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host_fqdn "^(?<host>[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname 
| rename fieldname AS host
| format ]
AND NOT
[| inputlookup lookupdefname2
| table fieldname
| rename fieldname AS host
| format ]
| dedup host
| where recentTime >= YourThresholdSecondsHere

View solution in original post

0 Karma

woodcock
Esteemed Legend

This has been solved many times including:
Meta Woot!: https://splunkbase.splunk.com/app/2949/
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

In any case, try this:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host_fqdn "^(?<host>[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname 
| rename fieldname AS host
| format ]
AND NOT
[| inputlookup lookupdefname2
| table fieldname
| rename fieldname AS host
| format ]
| dedup host
| where recentTime >= YourThresholdSecondsHere
0 Karma

rykermurdock77
Explorer

Thank you. I had went through and tried quite a few things, but this finally did it.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...