I have a lookup file which contains a list of hostnames under the field Host like below
Now how can I get the field values for those hosts in lookup from splunk for A,B and C like below
Host A B C
I am trying to find a simplified way if there is any in splunk instead of searching manually in splunk like below for each host
Host="chdg" OR Host="jkhgsdjh"........ | stats values (A), values(B), values(C) by Host
@pavanae, you might have to add more details on what you need. Whether you do not want to write the
Host names in base search or
fields names in stats functions? Try the following and confirm:
<your_base_search_with_index_and_sourcetype> [| inputlookup <yourCSVFile>.csv | table Host] | stats values(*) as * by Host
Please add more details also the context of what field names are and their corresponding value.
Is this what you’re looking for?
[| inputlookup hosts.csv host as Host | fields host | format ] | stats values(a) by host
Yes. Thank you. Although there is a small type on the query and corrected below :-
[| inputlookup hosts.csv | rename Host as host | fields host | format ] | stats values(a) by host