Help with search then loookup

[luuken]

Hi,

The following is my search:

index=pace ERROR OR FATAL OUI=* Number=*
| stats count by OUI Number
| sort -count

After executing the above search i get the following results:

OUI Number count

9C3DCF

4W12757WA51F6

18

80CC9C

4W15177LA0AD1

10

0836C9

4W150B70A3837

4

100C6B

4W15077PA0682

3

80CC9C

4W151778A0A39

3

80CC9C

4W15177GA0A5D

3 Note: The number column are the results I am interested in. I have a separate table named subsdeviceextract.csv as per the following: MAC Model OUI Post Code Serial Number 08:36:C9:9A:F4:6C V6510 0836C9 2775 4W150B70A012A 08:36:C9:9B:5C:FE V6510 0836C9 6437 4W150B70A07A8 08:36:C9:9C:A8:20 V6510 0836C9 2641 4W150B70A110A I would like to look up the Serial number to get the Model Number Please help me, thank you

[PickleRick]

Firstly - you did something strange with tables in your post. It's unreadable 🙂

Secondly - just use lookup.

index=pace ERROR OR FATAL OUI=* Number=*
| stats count by OUI Number
| sort -count
| lookup subsdeviceextract.csv "Serial Number" AS Number OUTPUT Model

[gcusello]

Hi @luuken,

you have to put your table in a lookup called e.g. subsdeviceextract.csv (for more infos see at (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup) and then run a search like this:

index=pace ERROR OR FATAL OUI=* Number=*
| stats count by OUI Number
| lookup subsdeviceextract.csv OUI OUTPUT Model
| sort -count
| table OUI Number count Model

If you like, you can use also other fields from your lookup.

Ciao.

Giuseppe