Splunk Search

How to match host fields between two separate lookups?

spluzer
Communicator

Hello all,

I have two lookups-- lookup1.csv with a "host" field and lookup2.csv with a "Host" field

I want to see if any hosts match 

Pretty silly, but IM blanking on this for some reason 

here is how I was doing it, but it doesn't seem to find the hit (even when I add it in a matching host purposefully for testing)

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| appendpipe [ | inputlookup lookup2.csv ]
| table host Host
| eval results = if(match(upper(Host),upper(host)), "hit", "miss")
| table host Host results



Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you put two lists of names next to each other, what are the chances two names in the same row will match?  That's what's happening here.

Appendpipe is the answer to a rare set of problems.  This is not one of them.

Pick one lookup as the base and use the lookup command to see if the name exists in the other file.  The command is case-insensitive so no need to shift case when comparing.  If the name doesn't exist in the 2nd file then the lookup command will return NULL.

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| lookup lookup2.csv Host as host OUTPUTNEW Host
| eval results = if(isnotnull(Host), "hit", "miss")
| table host Host results

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...