Splunk Cloud Platform

How to be able to read in a csv that has a listing of hosts and then use that listing of hosts to search an index?

NanSplk01
Path Finder

I have tried to create a search that uses a csv file for inputting a listing of hosts that I want to search for a particular EventID and if I find the ID we will create a ticket. I can list out the information (which is just a list of server/hosts) but I can't apply it to a search.

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Getting no results from a search like that could be normal, but I'll assume it isn't in your case.

The first thing to do when debugging a query containing a subsearch is to run the subsearch by itself.  Verify the results are as expected.  Make sure the field names returned all exist in the index(es) being searched by the main search.  For example, if the lookup file has the "Host" field, but the windows_dc index calls the same field "ComputerName" or "host" then there will be no returns. Fix that by inserting rename commands in the subsearch.

index=windows_dc EventID=4554 [
  | inputlookup SCOM-Servers-DC
  | fields Host
  | renamae Host as ComputerName
  ```Make sure fields are returned as key=value pairs```
  | format
] 
| fields + Host IP | search Host EventID

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the SPL you've tried and how it fails to meet expectations. The general format, however, is

index=foo [ | inputlookup hosts.csv ]
---
If this reply helps you, Karma would be appreciated.
0 Karma

NanSplk01
Path Finder

What I'm trying to do is use a list of servers/hosts to search for a particular EventID and if that EventID search is positive, send out a ticket.  This is what I have, but it's not working:

index=windows_dc EventID=4554 [| inputlookup SCOM-Servers-DC] | fields + Host IP | search Host EventID

I get no returns.

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Getting no results from a search like that could be normal, but I'll assume it isn't in your case.

The first thing to do when debugging a query containing a subsearch is to run the subsearch by itself.  Verify the results are as expected.  Make sure the field names returned all exist in the index(es) being searched by the main search.  For example, if the lookup file has the "Host" field, but the windows_dc index calls the same field "ComputerName" or "host" then there will be no returns. Fix that by inserting rename commands in the subsearch.

index=windows_dc EventID=4554 [
  | inputlookup SCOM-Servers-DC
  | fields Host
  | renamae Host as ComputerName
  ```Make sure fields are returned as key=value pairs```
  | format
] 
| fields + Host IP | search Host EventID

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

NanSplk01
Path Finder

Splunk worked with me to find the solution:

index=windows_dc EventID=4627  | lookup SCOM-Servers-EventID.csv Host as host OUTPUTNEW IP | eval lower_host=lower(host) | table lower_host IP | dedup lower_host

richgalloway's reply did help.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...