Splunk Search

How to compare output of a search to a lookup file?

mkamal18
New Member

Hello,

I have a lookup filled with hostnames. I want to compare the hostnames with the host field in the index.

If the hostname has data in the index then the status will be OK if not KO.

Could you please help me ?

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi mkamal18,
if in your lookup there's another field with values for each host (e.g. "description") try something like this

| metasearch index=my_index
| dedup host
| lookup mylookup.csv host OUTPUT description
| eval Status=if(description=*,""OK","KO")
| table host Status

if in your lookup there isn't any additional field, try something like this:

| metasearch index=my_index [ | inputlookup mylookup.csv | dedup host | fields host ]
| dedup host
| eval Status="OK"
| append [ 
   | metasearch index=my_index NOT [ | inputlookup mylookup.csv | dedup host | fields host ]
   | dedup host
   | eval Status="KO"
   ]
| table host Status

In both cases, beware to the case of the host.
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mkamal18,
if in your lookup there's another field with values for each host (e.g. "description") try something like this

| metasearch index=my_index
| dedup host
| lookup mylookup.csv host OUTPUT description
| eval Status=if(description=*,""OK","KO")
| table host Status

if in your lookup there isn't any additional field, try something like this:

| metasearch index=my_index [ | inputlookup mylookup.csv | dedup host | fields host ]
| dedup host
| eval Status="OK"
| append [ 
   | metasearch index=my_index NOT [ | inputlookup mylookup.csv | dedup host | fields host ]
   | dedup host
   | eval Status="KO"
   ]
| table host Status

In both cases, beware to the case of the host.
Bye.
Giuseppe

0 Karma

cboillot
Contributor

I know this was awhile ago, but how would one go about doing this to state if the host is just in the search results, only in the lookup, or in both?

0 Karma

mkamal18
New Member

Hello,

Thank you Giuseppe, It was really helpful. 🙂

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...