How to Bump a List with Data in Splunk to Get a Match

[_gkollias]

Hi All,

I have a list of invoice numbers that I want to try and find data for in Splunk. I added the list in a CSV but am having trouble getting other values in Splunk related to those InvoiceNumbers.

Here is where I have left off:

index=contract_gateway sourcetype=esb_audit bp_bp_name=Invoice 
| join type=outer InvoiceNumber [ | inputlookup ctg_invoice_check_lookup.csv | table InvoiceNumber ]

Along with this list I want to find other fields being logged (if they have even logged initally)...something like:

...| stats first(InvoiceNumber) as InvoiceNumber, latest(status) as exit_status, latest(other) as exit_message by bp_context_id 

is there a way to "append" these values with the list of invoice numbers in Splunk if they are being logged?

Thanks in advance!

[lguinn2 · Accepted solution]

Try it this way instead for your first search:

index=contract_gateway sourcetype=esb_audit bp_bp_name=Invoice [ | inputlookup ctg_invoice_check_lookup.csv 
 | table InvoiceNumber ]

This will retrieve the events with the InvoiceNumber(s) in the lookup table. I am unclear about the second part of your question, but you could try this:

... | stats first(InvoiceNumber) as InvoiceNumber, latest(status) as exit_status, latest(other) as exit_message 
       values(InvoiceNumber) as AllInvoices by bp_context_id

[_gkollias]

sorry for the late response on this.

This is exactly what I did - thanks for your response!