Splunk Search

How to create a search where if results under "query" field matches anything under hostname, then alert or show results?

YangThomas
New Member

Currently using splunkes' managed lookup table called hosts. There's a field too called hostname within the file.

I'm trying to create a search where if results under "query" field matches anything under hostname, then alert or show results.

here's what I have so far..

index=opendns
[ | inputlookup hosts
| search hostname
| table hostname query]

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @YangThomas,

in a subsearch you have to use the exact fieldnames of the main search, in other words i you want to match the hostname field (in the lookup) with the host field in the search, you have to rename it.

I don't understand what you want to match with the "query" field, also because query is a special name in SPL, anyway if query is a field both in the lookup and the main search, you could try something like this:

index=opendns
[ | inputlookup hosts
| rename hostname AS host
| table host query]

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...