Splunk Search

Help on basic question concerning lookup command

jip31
Motivator

Hello

I have a stranfge behavior concerning the search below

In the "host_allIND.csv" file, I have just HOSTNAME from a specific type which is "Type 1"

But when I run the search below, I have also HOSTNAME with type = "Type 2"

How is it possible to have events with HOSTNAME= Type 2 even if in "host_allIND.csv" lookup I have only HOSTNAME=Type 1?

 

`boot` 
| fields host BootTime 
| lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY 
| stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

 

 Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

We don't know what the boot macro does, but nothing else in the query limits the results to a particular host.  The lookup command adds three fields, but does not filter the results.  If "Type 2" is not in the lookup file then the SITE, DEPARTMENT, and CATEGORY fields will be null.

To filter out the "Type 1" hosts, use a where command or put the desired host into the base query.

`boot` host="Type 2"
| fields host BootTime 
| lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY 
| stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We don't know what the boot macro does, but nothing else in the query limits the results to a particular host.  The lookup command adds three fields, but does not filter the results.  If "Type 2" is not in the lookup file then the SITE, DEPARTMENT, and CATEGORY fields will be null.

To filter out the "Type 1" hosts, use a where command or put the desired host into the base query.

`boot` host="Type 2"
| fields host BootTime 
| lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY 
| stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

jip31
Motivator

thanks but  I thought that in so far as I stats my events with "by host", it just reuses the host existing in my CSV file.....

Tags (1)
0 Karma

aasabatini
Motivator

Hi,

Please can you explain better what you mean with type 1 or type 2?

anyway you can try to modify the lookup or use a subsearch to modify the output.

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...