Splunk Enterprise

compare field from search with field from csv file

sarit_s
Communicator

Hello

I have csv file with host names

also, i have this query :

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset"

this search returns the host name.

how can i search within the hosts in the csv file so only the ones from the file will return in my global search ?

thanks 

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @sarit_s,

Assuming you field host in CSV file, you can filter in the main search only.

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" [| inputlookup filename.csv | field host | format]

 

View solution in original post

0 Karma

manjunathmeti
Champion

hi @sarit_s,

Assuming you field host in CSV file, you can filter in the main search only.

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" [| inputlookup filename.csv | field host | format]

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...