Splunk Search

Extracting fields from look up file & calculating each field count

marellasunil
Communicator

Hi,
I am having a lookup csv file, I have uploaded it in Automatic lookup's with Application=Application_Name & Server_Name=host
Application_Name & host are listed in fields.
CSV file is as below

Application, Server_Name

App1, server1
App1, Server2
App1, Server3
App1, Server4
App2, Server2
App2, Server5
App2, Server6
App2, Server7

..| append [inputlookup servers_lookup] | search Application="App1" | chart count over Server_Name by Status
If I use the above command, I am getting the below output

Server count

server1 1
Server2 1
Server3 1
Server4 1

But If I run the query with host instead of Server_Name

Server count

server1 11
Server2 23
Server3 42
Server4 8
Which is actaul count.

Could you please help me to get the correct result by using lookfield

0 Karma
1 Solution

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

View solution in original post

0 Karma

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...