Hosts event search by lookup table

[ned692000]

Hi all,

I have created a lookup table and imported it into SPLUNK. It has 2 columns, one called hosts the other called IPs. The columns are populated with the hosts I want to query. I'm very new to SPLUNK and would like to create a search that returns errors/events worth investigating from the hosts specified in the lookup file. I'll display the results on a dashboard and will be checking this daily for preventative maintenance on my system. I'm just after events worth looking in to and need to filter out irrelevant events to save time. Can anyone help? Thanks in advance.

[manjunathmeti]

hi @ned692000,

You can filter index events using inputlookup in a sub-search like below. This will return the events for the hosts specified in the lookup file

index=indexname sourcetype=sourcetypename [| inputlookup lookup_table | fields hosts | rename hosts as host | format]

If this reply helps you, a like would be appreciated.

[ned692000]

Thanks for your reply, that worked and its very useful. I have a further question. Are there any keywords/ event ID's that I can use to filter out events for Linux machines? I have used event ID's for windows but not sure what to use for Linux. Thanks again

[isoutamo]

In Linux there are not same kind of event ids as Windows have. In Linux there are several logs like syslog which have several different events from several processes/daemons. Depending of your configuration you could have sourcetypes, tags or other keywords which you can use in our queries.
For further help we must know what and how you are collecting those logs and are you using some TA's for that or are you doing tokenisation by yourself.
r. Ismo

[ned692000]

Hi,

Thanks for the reply, it's taking everything from var/messages via a forwarder. Is there anything I can use as a filter to reduce UN-useful messages. i.e. things I need to keep an eye on, rather than just normal system events