Splunk Enterprise

How to compare between two inputlookup to get unmatched host w.r.t to lookup1?

Ash17
Observer

We want to compare 2 inputlookup files. Lets say we have fields in lookup 1-
host- abc, bcd, def, xyz,
& lookup 2
host- bcd, xyz
required result = abc, def
simply we want to show the count of the host missing in lookup 1 when compared to lookup 2.


we have already tried
| inputlookup lookup2 |join type=left host [inputlookup lookup1 |eval check="match" ] |search NOT check=*

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup lookup2 
| eval lookup="lookup2"
| append [| inputlookup lookup1 ]
| stats count values(lookup) as lookup by host
| where count=1 AND lookup="lookup2"
| stats count
0 Karma

Ash17
Observer

Thanks for the effort, but it not giving the correct result

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way is it wrong?

0 Karma

Ash17
Observer

I am getting host on both the lookup files from this search. And we want only missing host from lookup1when it is compared with 2nd lookup

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The hosts have to match completely - do you perhaps have some trailing or leading spaces for example which are in one lookup but not in the other?

0 Karma

Ash17
Observer

yes they are matching completely.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...