Getting Data In

Loops on csv file

kacel
New Member

hi,
i comeback to ask u again about my problem ;
so :
| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*"
| foreach Hostname [eval temp = if(match(Parent,Hostname), "hello", "Noooooo") ]
| table temp

when i execut this the result is :
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo

the problem i me sur ther is a value from Parent that match Hostname
i want to that retun hello .
not only comparing in same raw that is the problem
thank you

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@kacel,

Try this

| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", 
                  Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", 
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*" 
| eventstats values(Parent) as _tmp
| eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kacel,

Try this

| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", 
                  Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", 
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*" 
| eventstats values(Parent) as _tmp
| eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)
Happy Splunking!
0 Karma

kacel
New Member

Thank you very much the result shows 1 when it is a match and 0 else .

its the best way to find same value of coulumn without using loops between two culumn
thank u.

0 Karma

kacel
New Member

could you give us an explication please ?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

sure. Last two lines can be rewritten as below to give a better idea

| eventstats values(Parent) as tmp
 | eval found=if(isnull(mvfind(tmp,Hostname)),0,1)

By using eventstats we create a list of "Parents" for each row. Host name is then matched against this list which returns null for non-matching and an index for matching records . The result is then evaluated using if and assigns to "found" . 1 and 0 can be replaced with any values for e.g. "Yes","No" etc

Hope this helps!

Happy Splunking!
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Parent and Hostname must match exactly.
Please edit your query to show how the Parent and Hostname fields are obtained.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...