Splunk Search

How to match host fields between two separate lookups?


Hello all,

I have two lookups-- lookup1.csv with a "host" field and lookup2.csv with a "Host" field

I want to see if any hosts match 

Pretty silly, but IM blanking on this for some reason 

here is how I was doing it, but it doesn't seem to find the hit (even when I add it in a matching host purposefully for testing)

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| appendpipe [ | inputlookup lookup2.csv ]
| table host Host
| eval results = if(match(upper(Host),upper(host)), "hit", "miss")
| table host Host results

Labels (1)
0 Karma


If you put two lists of names next to each other, what are the chances two names in the same row will match?  That's what's happening here.

Appendpipe is the answer to a rare set of problems.  This is not one of them.

Pick one lookup as the base and use the lookup command to see if the name exists in the other file.  The command is case-insensitive so no need to shift case when comparing.  If the name doesn't exist in the 2nd file then the lookup command will return NULL.

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| lookup lookup2.csv Host as host OUTPUTNEW Host
| eval results = if(isnotnull(Host), "hit", "miss")
| table host Host results


If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...