Splunk Search

How to match host fields between two separate lookups?

spluzer
Communicator

Hello all,

I have two lookups-- lookup1.csv with a "host" field and lookup2.csv with a "Host" field

I want to see if any hosts match 

Pretty silly, but IM blanking on this for some reason 

here is how I was doing it, but it doesn't seem to find the hit (even when I add it in a matching host purposefully for testing)

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| appendpipe [ | inputlookup lookup2.csv ]
| table host Host
| eval results = if(match(upper(Host),upper(host)), "hit", "miss")
| table host Host results



Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you put two lists of names next to each other, what are the chances two names in the same row will match?  That's what's happening here.

Appendpipe is the answer to a rare set of problems.  This is not one of them.

Pick one lookup as the base and use the lookup command to see if the name exists in the other file.  The command is case-insensitive so no need to shift case when comparing.  If the name doesn't exist in the 2nd file then the lookup command will return NULL.

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| lookup lookup2.csv Host as host OUTPUTNEW Host
| eval results = if(isnotnull(Host), "hit", "miss")
| table host Host results

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...