Splunk Search

How to edit an inputlookup search that displays table of hostnames against corresponding indexes?

gener_yc
Explorer

I have an inputlookup called hosts.csv that looks like this:

host
----------
hostname1
hostname2
hostname3
hostname4

I want to list all indexes containing the value of host in raw data against that hostname. So the output I am looking for is...

host                index
------------------------------
hostname1        firewall
                 web
                 unix
                 proxy
hostname2        firewall
                 database
                 unix
                 dmz
hostname3        firewall
                 proxy
hostname4        firewall
                 proxy
                 windows 

I have tried using the search below which gives me matching indexes containing the hostnames in raw data. But I am not able to create a table to list the hostnames against the indexes.

[|inputlookup hosts.csv|table host|rename host as search|format]|stats values(index)

I tried adding code...|lookup hosts.csv host OUTPUT host| stats values(index) by host and get no results. Can you please help me obtain the output above?

Thanks!

pradeepkumarg
Influencer
|tstats count WHERE index=* by host,index| table host index | search [|inputlookup hosts.csv] | stats values(index) by host
0 Karma

gener_yc
Explorer

I still get No results found.

0 Karma

gener_yc
Explorer

Yes they match, even though they are part of an fqdn I can see them in raw data when I query for them using ...|rename host as search|format.

Also splunk produces a list of matching indices when I use the query [|inputlookup hosts.csv|table host|rename host as search|format]|stats values(index).

I just am struggling to append the index list with the hostnames from the lookup.

0 Karma

pradeepkumarg
Influencer

does the host name in your lookup match exactly with the host names in your splunk data?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...