Splunk Search

Can you help me do an outputlookup with a condition?

jip31
Motivator

Hello

I use the code below.

I'm doing an outputlookup at the end of the query, but I want to do it with a condition.

The condition is that Build=1511.

Do i have to use a where command or there is another solution please??

eventtype="AppliEV" Level=* 
| dedup host 
| stats count by host 
| append 
    [ search index="ai-wkst-windows-fr" sourcetype=WinRegistry key_path="\\registry\\machine\\xx" 
        OR 
        key_path="\\registry\\machine\\xx" 
    | eval OS=if(key_path=="\\registry\\machine\\software\\xx), 
        Build=if(key_path=="\\registry\\machine\\software\\xx) 
    | stats latest(OS) as OS latest(Build) as Build by host ] 
| stats values(OS) as OS values(Build) as Build by host 
| stats count as Total by OS Build host | fields - host | outputlookup build.csv
1 Solution

nryabykh
Path Finder

Hi!

You can use a where command in this way:


...
| stats count as Total by OS Build host
| fields - host
| appendpipe
[where Build="1511"
| outputlookup override_if_empty=f build.csv
| where nofield="novalue"]

It helps to avoid overriding build.csv with empty file in case of Build is not 1511.

View solution in original post

nryabykh
Path Finder

Hi!

You can use a where command in this way:


...
| stats count as Total by OS Build host
| fields - host
| appendpipe
[where Build="1511"
| outputlookup override_if_empty=f build.csv
| where nofield="novalue"]

It helps to avoid overriding build.csv with empty file in case of Build is not 1511.

grittonc
Contributor

This is awesome! Thank you.

0 Karma

jip31
Motivator

many thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...