Getting Data In

Inputlookup Exception List not filtering

rykermurdock77
Explorer

I have a report that shows me all "missing" hosts across our network. I have created a lookup file and definition to filter out any systems we have decommissioned (lookupdefname) and any systems that have been found new on our network within the last 30 days.(lookupdefname2). Even though i've followed step by step how to build this search, it isn't filtering like it should. Any help is appreciated:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host "^(?[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname ] NOT
[| inputlookup lookupdefname2
| table fieldname]
| dedup host
| where recentTime

0 Karma
1 Solution

woodcock
Esteemed Legend

This has been solved many times including:
Meta Woot!: https://splunkbase.splunk.com/app/2949/
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

In any case, try this:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host_fqdn "^(?<host>[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname 
| rename fieldname AS host
| format ]
AND NOT
[| inputlookup lookupdefname2
| table fieldname
| rename fieldname AS host
| format ]
| dedup host
| where recentTime >= YourThresholdSecondsHere

View solution in original post

0 Karma

woodcock
Esteemed Legend

This has been solved many times including:
Meta Woot!: https://splunkbase.splunk.com/app/2949/
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

In any case, try this:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host_fqdn "^(?<host>[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname 
| rename fieldname AS host
| format ]
AND NOT
[| inputlookup lookupdefname2
| table fieldname
| rename fieldname AS host
| format ]
| dedup host
| where recentTime >= YourThresholdSecondsHere

View solution in original post

0 Karma

rykermurdock77
Explorer

Thank you. I had went through and tried quite a few things, but this finally did it.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!