Splunk Search

How do I join an inputlookup and a tstats search?

PotatoDataUser
Engager

So I have a lookup file with a complete list of servers and their details like version, owner etc, and an index my_index that gets logs from servers.

This is the search I am using right now

| inputlookup my_lookup.csv
| join type=left server_name
   [ | tstats count where index=my_index by host
      | eval reporting="yes"]

| eval reporting=if(isnull(reporting),"No","Yes")


I want to validate the list by referencing it against the tstats reports and show the whole list of the lookupfile.

What I want to know is if this search is accurate, will the subsearch truncate results giving me inaccurate output, is there any alternate way to write this search, Please help.

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust
| tstats ...
| inputlookup append=t ...
| stats values(*) as * by host

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust
| tstats ...
| inputlookup append=t ...
| stats values(*) as * by host

 

gcusello
SplunkTrust
SplunkTrust

Hi @PotatoDataUser ,

try using the lookup command (https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Lookup)

| tstats count where index=my_index by host
| lookup my_lookup.csv server_name

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...