How to be able to read in a csv that has a listing of hosts and then use that listing of hosts to search an index?

[NanSplk01]

I have tried to create a search that uses a csv file for inputting a listing of hosts that I want to search for a particular EventID and if I find the ID we will create a ticket. I can list out the information (which is just a list of server/hosts) but I can't apply it to a search.

[richgalloway]

Please share the SPL you've tried and how it fails to meet expectations. The general format, however, is

index=foo [ | inputlookup hosts.csv ]

[NanSplk01]

What I'm trying to do is use a list of servers/hosts to search for a particular EventID and if that EventID search is positive, send out a ticket.  This is what I have, but it's not working:

index=windows_dc EventID=4554 [| inputlookup SCOM-Servers-DC] | fields + Host IP | search Host EventID

I get no returns.

[richgalloway · Accepted solution]

Getting no results from a search like that could be normal, but I'll assume it isn't in your case.

The first thing to do when debugging a query containing a subsearch is to run the subsearch by itself.  Verify the results are as expected.  Make sure the field names returned all exist in the index(es) being searched by the main search.  For example, if the lookup file has the "Host" field, but the windows_dc index calls the same field "ComputerName" or "host" then there will be no returns. Fix that by inserting rename commands in the subsearch.

index=windows_dc EventID=4554 [
  | inputlookup SCOM-Servers-DC
  | fields Host
  | renamae Host as ComputerName
  ```Make sure fields are returned as key=value pairs```
  | format
] 
| fields + Host IP | search Host EventID

[NanSplk01]

Splunk worked with me to find the solution:

index=windows_dc EventID=4627  | lookup SCOM-Servers-EventID.csv Host as host OUTPUTNEW IP | eval lower_host=lower(host) | table lower_host IP | dedup lower_host

richgalloway's reply did help.