Splunk Search

How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C?

Builder

I have a lookup file which contains a list of hostnames under the field Host like below

Host
abd
addf
fdfs

Now how can I get the field values for those hosts in lookup from splunk for A,B and C like below

Host A B C

I am trying to find a simplified way if there is any in splunk instead of searching manually in splunk like below for each host

Host="chdg" OR Host="jkhgsdjh"........ | stats values (A), values(B), values(C) by Host

1 Solution

SplunkTrust
SplunkTrust

Is this what you’re looking for?

[| inputlookup hosts.csv host as Host | fields host | format ] | stats values(a) by host

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Is this what you’re looking for?

[| inputlookup hosts.csv host as Host | fields host | format ] | stats values(a) by host

View solution in original post

0 Karma

Builder

Yes. Thank you. Although there is a small type on the query and corrected below :-

[| inputlookup hosts.csv | rename Host as host | fields host | format ] | stats values(a) by host

0 Karma

SplunkTrust
SplunkTrust

@pavanae, you might have to add more details on what you need. Whether you do not want to write the Host names in base search or fields names in stats functions? Try the following and confirm:

<your_base_search_with_index_and_sourcetype> [| inputlookup <yourCSVFile>.csv | table Host]
| stats values(*) as * by Host

Please add more details also the context of what field names are and their corresponding value.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma