Getting Data In

Loops on csv file

kacel
New Member

hi,
i comeback to ask u again about my problem ;
so :
| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*"
| foreach Hostname [eval temp = if(match(Parent,Hostname), "hello", "Noooooo") ]
| table temp

when i execut this the result is :
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo

the problem i me sur ther is a value from Parent that match Hostname
i want to that retun hello .
not only comparing in same raw that is the problem
thank you

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@kacel,

Try this

| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", 
                  Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", 
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*" 
| eventstats values(Parent) as _tmp
| eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kacel,

Try this

| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", 
                  Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", 
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*" 
| eventstats values(Parent) as _tmp
| eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)
Happy Splunking!
0 Karma

kacel
New Member

Thank you very much the result shows 1 when it is a match and 0 else .

its the best way to find same value of coulumn without using loops between two culumn
thank u.

0 Karma

kacel
New Member

could you give us an explication please ?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

sure. Last two lines can be rewritten as below to give a better idea

| eventstats values(Parent) as tmp
 | eval found=if(isnull(mvfind(tmp,Hostname)),0,1)

By using eventstats we create a list of "Parents" for each row. Host name is then matched against this list which returns null for non-matching and an index for matching records . The result is then evaluated using if and assigns to "found" . 1 and 0 can be replaced with any values for e.g. "Yes","No" etc

Hope this helps!

Happy Splunking!
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Parent and Hostname must match exactly.
Please edit your query to show how the Parent and Hostname fields are obtained.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...