Splunk Search

Can you help me integrate a lookup into a search?

donemery
Explorer

I am trying to integrate a lookup into a search with no success. My goal is to run the search, lookup the hostname or TID and compare it to the lookup table (HOSTNAME field) and return results based on matches to the ROLE field. The ROLE column in the lookup that defines whether TID is core, cpe or aggregation. Here is my search:

index=my_main "SFP receive power low  alarm set" 
| stats dc(date_mday) as Days, count by TID, J_Port | eval c_TID=upper(c_TID) 
| where Days > 2 AND count > 49 | appendpipe [stats count | where count=0]
| rename count as "Total Errors", TID as Hostname, J_Port as Port
| sort -"Total Errors"

The lookup table file and definition are working. My difficulty is integrating it into my search.

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

I don't see your lookup in the search. It should follow this format

| lookup filename.csv hostname AS host OUTPUT ROLE

View solution in original post

0 Karma

Vijeta
Influencer

Place it at the end of the search, and if you still get the error please paste the complete search with lookup and the error message.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I don't see your lookup in the search. It should follow this format

| lookup filename.csv hostname AS host OUTPUT ROLE

0 Karma

donemery
Explorer

I didn't include it in the search because no matter where I try it, I get an error back when it is executed. Any guidance as to the proper placement of the lookup is appreciated.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

For performance purposes, its always better to have a stats before the lookup. Place it like this

index=my_main "SFP receive power low  alarm set" 
 | stats dc(date_mday) as Days, count by TID, J_Port | eval c_TID=upper(c_TID) 
| lookup filename.csv hostname AS host OUTPUT ROLE
 | where Days > 2 AND count > 49 | appendpipe [stats count | where count=0]
 | rename count as "Total Errors", TID as Hostname, J_Port as Port
 | sort -"Total Errors"

donemery
Explorer

It's working now. Thanks!

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...