Splunk Search

Check to compare value with csv contents

davidcraven02
Communicator

I'm trying to build a pass/fail check to see if a machine already exists in a csv, as I have a dashboard with a text input where a machine name can be entered.

Below is my search which displays all the machines from the csv, combining them into one line.

alt text

Tags (3)
0 Karma
1 Solution

cmerriman
Super Champion

try adding something like this:

|eval exists=if(like(machine,"%$token$%"),1,0)

where the token is the dashboard text input

View solution in original post

cmerriman
Super Champion

try adding something like this:

|eval exists=if(like(machine,"%$token$%"),1,0)

where the token is the dashboard text input

davidcraven02
Communicator

Thank you for this but how would I add a pass or fail to display this?

0 Karma

cmerriman
Super Champion

what is your desired output, exactly?

do you just want a dashboard panel that says "pass" or "fail"? if so, add |eval exists=if(like(machine,"%$token$%"),"pass","fail")|table exists and display as a single value, maybe?

0 Karma

davidcraven02
Communicator

Thank you!!!!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...