Splunk Search

Extracting fields from look up file & calculating each field count

marellasunil
Communicator

Hi,
I am having a lookup csv file, I have uploaded it in Automatic lookup's with Application=Application_Name & Server_Name=host
Application_Name & host are listed in fields.
CSV file is as below

Application, Server_Name

App1, server1
App1, Server2
App1, Server3
App1, Server4
App2, Server2
App2, Server5
App2, Server6
App2, Server7

..| append [inputlookup servers_lookup] | search Application="App1" | chart count over Server_Name by Status
If I use the above command, I am getting the below output

Server count

server1 1
Server2 1
Server3 1
Server4 1

But If I run the query with host instead of Server_Name

Server count

server1 11
Server2 23
Server3 42
Server4 8
Which is actaul count.

Could you please help me to get the correct result by using lookfield

0 Karma
1 Solution

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

View solution in original post

0 Karma

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...