Splunk Search

Extracting fields from look up file & calculating each field count

marellasunil
Communicator

Hi,
I am having a lookup csv file, I have uploaded it in Automatic lookup's with Application=Application_Name & Server_Name=host
Application_Name & host are listed in fields.
CSV file is as below

Application, Server_Name

App1, server1
App1, Server2
App1, Server3
App1, Server4
App2, Server2
App2, Server5
App2, Server6
App2, Server7

..| append [inputlookup servers_lookup] | search Application="App1" | chart count over Server_Name by Status
If I use the above command, I am getting the below output

Server count

server1 1
Server2 1
Server3 1
Server4 1

But If I run the query with host instead of Server_Name

Server count

server1 11
Server2 23
Server3 42
Server4 8
Which is actaul count.

Could you please help me to get the correct result by using lookfield

0 Karma
1 Solution

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

View solution in original post

0 Karma

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...