Splunk Cloud Platform

how to build a search with lookup file

Ruben_sb1
Explorer

Hello,

I would like to know  how to build a search  with  using lookup result

I mean

 

I have a list(assent_server.csv)  with my  servers  with the follow   filds (ip,priority,nt_host)

 

Ejemple:

ip,priority,nt_host

10.10.1.1,critical,SERVER01

10.10.1.2,critical,SERVER02

10.10.1.2,critical,SERVER02

 

 

So I  need to create the next to:

 

Search  any  servers that  I have in the file assent_server.csv and get  the log fiels.

I  had tried  with this search

1)index="win*" host=[|inputlookup asset_list | fields ip]

2)index="win*"  | search host=[|inputlookup asset_list | fields nt_host] 

but  I get this  result:

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side:

 

 

 

 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

please try 

index="win*" [|inputlookup asset_list | fields ip | rename ip as host | format]

r. Ismo 

View solution in original post

0 Karma

Ruben_sb1
Explorer

i have the same error 😞

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

please try 

index="win*" [|inputlookup asset_list | fields ip | rename ip as host | format]

r. Ismo 

0 Karma

Ruben_sb1
Explorer

perfect,

 

index="win*" [|inputlookup asset_list | search priority="critical" | fields nt_host |rename nt_host as host | format]| top limit=2000 host

 

but

Can you say me why it work?
what is the splunk's logica.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You understand it after you run only that sub search, read what the format do and then remember that sub search has run first. Basically the result of sub search has added to main search and then it has ran.
r. Ismo
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you show index=win* what kind of events you have?
0 Karma

Ruben_sb1
Explorer

hello.

 

I tried but I haven't gotten result the result was 0

Ruben_sb1_0-1599919563673.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you try something like

index="win*" host IN [|inputlookup asset_list | fields ip]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...