Splunk Search

How to combine results of inputlookup and a search to a table?

tcpcannon
Loves-to-Learn Lots

I want to search from a lookup table, get a field, and compare it to a search and pull the fields from that search based off of a common field. I would rather not use |set diff and its currently only showing the data from the inputlookup.

 

 

 

 

| set diff
[| inputlookup all_mid-tiers WHERE host="ACN*" 
    | fields username Unit ]
    [ search index=iis 
        [| inputlookup all_mid-tiers WHERE host="ACN*" 
        | fields username ] 
    | dedup username 
    | dedup SiteIDOverride
    | eval username=lower(username) 
    | fields username SiteIDOverride unitType installVer os jkversion
        ] 
| join type=left
    [ search index="iis" sourcetype="iis" earliest=-7d@d 
        [| inputlookup all_mid-tiers Where host="*ACN*" 
        | fields username]   
    | dedup username 
    | eval username=lower(username) 
    | eval timedelta=now()-_time 
    | eval time_delta_days=floor(timedelta/86400) 
    | stats first(time_delta_days) as Status by username 
    | eval Status=if(Status<"0","0",Status) 
    | eval StatA=Status 
    | rangemap field=StatA OK=0-0 Monitor=1-1 Contact=2-9999 
    | rename range as Status 
        ] 

| lookup all_mid-tiers host AS SiteIDOverride OUTPUT Unit Weaponsystem Last_access
| eval Last_access=strftime(Last_access, "%Y-%m-%d")
| rename Weaponsystem as unitType
| dedup Unit

| table Status Unit SiteIDOverride unitType installVer os jkversion Last_access

 

 

I can't seem to get it to pull SiteIDOverride unitType...^^ from the search. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...