Hi all,
I have created a lookup table and imported it into SPLUNK. It has 2 columns, one called hosts the other called IPs. The columns are populated with the hosts I want to query. I'm very new to SPLUNK and would like to create a search that returns errors/events worth investigating from the hosts specified in the lookup file. I'll display the results on a dashboard and will be checking this daily for preventative maintenance on my system. I'm just after events worth looking in to and need to filter out irrelevant events to save time. Can anyone help? Thanks in advance.
hi @ned692000,
You can filter index events using inputlookup in a sub-search like below. This will return the events for the hosts specified in the lookup file
index=indexname sourcetype=sourcetypename [| inputlookup lookup_table | fields hosts | rename hosts as host | format]
If this reply helps you, a like would be appreciated.
Thanks for your reply, that worked and its very useful. I have a further question. Are there any keywords/ event ID's that I can use to filter out events for Linux machines? I have used event ID's for windows but not sure what to use for Linux. Thanks again
Hi,
Thanks for the reply, it's taking everything from var/messages via a forwarder. Is there anything I can use as a filter to reduce UN-useful messages. i.e. things I need to keep an eye on, rather than just normal system events