Knowledge Management

help on comparison between 2 lookup

jip31
Motivator

hi

I use the search below in order to retrieve the fields host ,SITE and STATUS from a lookup and to compare them with the field host in another lookup
| inputlookup host.csv
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE STATUS
| stats values(SITE) as SITE, values(STATUS) as STATUS by host

Now I need to display the host that exist in a lookup but not in another lookup
could you help me please??

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
do you want this in the same search or in another one?

if in another one it's easy:

| inputlookup host.csv NOT [ |inputlookup lookup_cmdb_fo_all.csv | rename HOSTNAME AS host | fields host ]
| ...

if instead you want this in the same search you have to modify your search in this way:

| inputlookup host.csv
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE STATUS
| stats values(SITE) as SITE, values(STATUS) as STATUS by host
| eval Status=if(isnull(SITE),"Not present","Present")

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
do you want this in the same search or in another one?

if in another one it's easy:

| inputlookup host.csv NOT [ |inputlookup lookup_cmdb_fo_all.csv | rename HOSTNAME AS host | fields host ]
| ...

if instead you want this in the same search you have to modify your search in this way:

| inputlookup host.csv
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE STATUS
| stats values(SITE) as SITE, values(STATUS) as STATUS by host
| eval Status=if(isnull(SITE),"Not present","Present")

Ciao.
Giuseppe

jip31
Motivator

hi guiseppe perfect thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...