Splunk Enterprise

compare field from search with field from csv file

sarit_s
Communicator

Hello

I have csv file with host names

also, i have this query :

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset"

this search returns the host name.

how can i search within the hosts in the csv file so only the ones from the file will return in my global search ?

thanks 

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @sarit_s,

Assuming you field host in CSV file, you can filter in the main search only.

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" [| inputlookup filename.csv | field host | format]

 

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @sarit_s,

Assuming you field host in CSV file, you can filter in the main search only.

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" [| inputlookup filename.csv | field host | format]

 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...