Splunk Search

How to compare a lookup field value with my current search?

AdixitSplunk
Path Finder

HI All,
I have a lookup table with host names value around 10 field name host.
I have this search index=Application sourcetype=Servers |stats count by host

I have to compare host in Lookup table with the one in above search and result should give only those host names which are not present in Lookup file.

Suppose my lookup file has below host names:

host
1
2
3
4 
5

My search gives:

host
1 
4
5

So the final result should be :

host
2
3

Thanks in advance.

Tags (2)
0 Karma
1 Solution

AdixitSplunk
Path Finder

Thanks for your reply but its not giving the right answer . The below did :slightly_smiling_face:

index="Application" sourcetype=Servers|eval host=lower(host)|eval started_host="T"|append [inputlookup Mylookup|eval started_host="F"]|stats count(eval(started_host=="T")) as started by host|where started == 0

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=Application sourcetype=Servers | stats count by host | appendpipe [|inputlookup hostLookup | table host | eval sourcetype="LOOKUP"] | stats values(*) AS * dc(sourcetype) AS numDatasets BY host | search numDatasets=1 AND sourcetype="LOOKUP" | table host
0 Karma

AdixitSplunk
Path Finder

Thanks for your reply but its not giving the right answer . The below did :slightly_smiling_face:

index="Application" sourcetype=Servers|eval host=lower(host)|eval started_host="T"|append [inputlookup Mylookup|eval started_host="F"]|stats count(eval(started_host=="T")) as started by host|where started == 0
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@AdixitSplunk - Did your above comment provide a working solution to your question? If yes and you would like to close out your post, please let me know so I can convert it to an Answer to be accepted. Thanks!

0 Karma

adayton20
Contributor

Try this:

index=Application sourcetype=Servers
| search [|inputlookup yourLookup | fields + host | table host] 
| stats count by host
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...