Splunk Search

How to combine results of inputlookup and a search to a table?

tcpcannon
Loves-to-Learn Lots

I want to search from a lookup table, get a field, and compare it to a search and pull the fields from that search based off of a common field. I would rather not use |set diff and its currently only showing the data from the inputlookup.

 

 

 

 

| set diff
[| inputlookup all_mid-tiers WHERE host="ACN*" 
    | fields username Unit ]
    [ search index=iis 
        [| inputlookup all_mid-tiers WHERE host="ACN*" 
        | fields username ] 
    | dedup username 
    | dedup SiteIDOverride
    | eval username=lower(username) 
    | fields username SiteIDOverride unitType installVer os jkversion
        ] 
| join type=left
    [ search index="iis" sourcetype="iis" earliest=-7d@d 
        [| inputlookup all_mid-tiers Where host="*ACN*" 
        | fields username]   
    | dedup username 
    | eval username=lower(username) 
    | eval timedelta=now()-_time 
    | eval time_delta_days=floor(timedelta/86400) 
    | stats first(time_delta_days) as Status by username 
    | eval Status=if(Status<"0","0",Status) 
    | eval StatA=Status 
    | rangemap field=StatA OK=0-0 Monitor=1-1 Contact=2-9999 
    | rename range as Status 
        ] 

| lookup all_mid-tiers host AS SiteIDOverride OUTPUT Unit Weaponsystem Last_access
| eval Last_access=strftime(Last_access, "%Y-%m-%d")
| rename Weaponsystem as unitType
| dedup Unit

| table Status Unit SiteIDOverride unitType installVer os jkversion Last_access

 

 

I can't seem to get it to pull SiteIDOverride unitType...^^ from the search. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...