How come this doesn't work given indexers.csv is a list of Splunk servers with role indexer?

[albledsoe]

How come this doesn't work given indexers.csv is a list of Splunk servers with role Indexer?

| inputlookup indexers.csv| rename splunk_server as Indxr| foreach Indxr [search index=_introspection sourcetype=splunk_resource_usage component=IOStats host=Indxr | eval reads_ps = 'data.reads_ps'| eval writes_ps = 'data.writes_ps' | eval writes_ps=avg(write_ps) | eval reads_ps=avg(reads_ps)]

[bowesmana · Accepted solution]

That is not what foreach is designed for. It looks like you want to run a search using the value of each splunk_server in your lookup, so use a subsearch like this

index=_introspection sourcetype=splunk_resource_usage component=IOStats [
  | inputlookup indexers.csv 
  | rename splunk_server as host 
]
| eval reads_ps = 'data.reads_ps' 
| eval writes_ps = 'data.writes_ps' 

I have left out the last two avg() statements as that is not how eval works - eval is to perform an action on a single event. If you want to create averages, use some form of stats command, e.g.

| stats avg(write_ps) as writes_ps avg(reads_ps) as reads_ps by host

[albledsoe]

Yep, that's it. It's been sometime since I wrote SPL.  I had been using the REST API in Bash and Javascript. But many don't want to run my scripts. So I am trying to convert to copy/paste SPL. Thanks for the quick tutorial.