Splunk Search

How to get the where condition from a lookup source, work?

Contributor

Hello

I dont understand why my "where" condition doesnt work
could you help me please?

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 |where HealthState00 > 99 | stats count by host
0 Karma
1 Solution

Contributor

But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population

View solution in original post

0 Karma

Contributor

But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population

View solution in original post

0 Karma

Contributor

I found!
I added brackets like this where HealthState00 > "90,00"

0 Karma

Influencer

@jip31 Just remove stats count by host and see if it gives you any results.

0 Karma

Contributor

when I m doing | inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
I have results

0 Karma

Revered Legend

Does your PanaBatteryStatus.csv lookup has field called Hostname00 and host.csv has a field host?

0 Karma

Contributor

Yes for both

0 Karma

Revered Legend

Ok.. Does the field values match exactly (by default the lookup match is case sensitive) between two lookup table files (Hostname00 from PanaBatteryStatus.csv and host from host.csv)? Also, when you say the where condition doesn't work, does it not filter the data OR it's filtering all data?

0 Karma

Contributor

yes they match exacly
when I add the where conditions I have any results

0 Karma

SplunkTrust
SplunkTrust

add 'host' after OUTPUT as you are using in stats

0 Karma

Contributor

when I m doing | inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
I have results
but if I add host after output, I have no results

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!