Splunk Search

Help with lookup

hank72
Path Finder

Hi. Please I need some help.

Different devices, all with different port numbers. How to create a single search that will use lookup table to check multiple devices and different portid with notes?

device,portid,notes
device1,2,cube1
device1,4,cube7
device1,6,cube8
device2,5,cube3
device2,6,cube2
device3,1,cube6
device3,5,cube9
device3,7,cube4

This is a search for one device (device1) and it's ports. But now I have many more devices all with different ports.
index=myindex device=device1 type=port speed=1Gfdx state=down | where in(portid,2,4,6) | table device, portid, state

Thank you.
Hank

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A subsearch should do it. The format command converts the fields into ((device=1 port=2) OR (device=1 port=4)...).

index=myindex speed=1Gfdx state=down
   [ | inputlookup mylookup | fields device,portid | format ]
| table device, portid, state
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...