Splunk Search

How can Splunk loop through a list of numbers and do an action against each of them?

koshyk
Super Champion

We have got a problem to find a list of 500+ client servers (but less than 1000), which are missing DNS entries. the servers have a pattern luckily . Let's say for example, the server names are myhost001 to myhost999

So we want to loop through all those servers and do a dnslookup

|makeresults
| eval src_host_001="myhost001"
...
| eval src_host_999="myhost999"
| foreach src_host_* [eval src_host=<<FIELD>>]
|lookup dnslookup clienthost as src_host OUTPUTNEW clientip

Is there a way, we can loop using a pattern, so I don't want to use a lookup file or external csv?
Ideally the logic I'm trying to replicate is
for a range of myhost[0-9][0-9][0-9] , loop through each of them and do a dnslookup

So something like in sort of

for id in $( seq 1 999 ); do {
    src_host=myhost${id}
   ##|lookup dnslookup clienthost as ${src_host} OUTPUTNEW clientip
}

thanks in advance

to4kawa
Ultra Champion
| makeresults count=999
| streamstats count 
| eval count=printf("%03d",count) 
| eval src_host="myhost".count
|lookup dnslookup clienthost as src_host OUTPUTNEW clientip

Hi, folks
How about this?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @koshyk,

Try this:

| makeresults count=999 
| eval number = 1 
| streamstats sum(number) as number 
| eval src_host=case(len(number)==1, "myhost00".number, len(number)==2, "myhost0".number, 1==1, "myhost".number)
| lookup dnslookup clienthost as src_host OUTPUTNEW clientip
0 Karma

richgalloway
SplunkTrust
SplunkTrust

TBH, this is probably easier to do with a bash script.

---
If this reply helps you, Karma would be appreciated.

koshyk
Super Champion

wished we had got access to backend 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...