Splunk Search

Compare field with lookup

New Member

Hi

I have a lookup table containg the host name and a software version

hostlookup.csv

hostname,version
hostA,2
hostB,2
hostC,3

Each host is sending the current installed software version each 5 min to splunk.

How can I create a table like this. I Iike to compare if a host has installed the right software version.

hostname, installed_version, expected_version, result
hostA, 2, 2, OK
hostB, 3, 2, WRONG
hostC, 2, 3, WRONG
0 Karma

Champion

Try this!

(your search)
|rename version as installedversion
|lookup hostname hostlookup.csv output version as expected
version]
|eval result=if(installedversion=expectedversion,"OK","WRONG")
|table hostname, installedversion, expectedversion, result

0 Karma

Path Finder

weird ... I see ] without a [

0 Karma

Champion

It is a typo.

as expectedversion]

as expected
version

0 Karma