Compare two lookup tables

brent_weaver · ‎10-21-2019

Hello all... I have to compare two lookup table files in splunk. One is a list of hosts that should Be logging, and the other is a list of what isnt logging. I tried a few different things, to no avail. My goal is to build a list of what isnt logging compared to the list of what is logging.

I mean this is splunk, it cant be that hard 🙂

sandeepmakkena · ‎10-21-2019

| inputlookup lookupfile1 | lookup lookupfile2 host OUTPUTNEW host as isFound | where isnull(isFound)

Hope this helps, Thanks!

Compare two lookup tables

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Compare two lookup tables

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling