Splunk Search

How to pass the value in main query from the lookup file in a list of servers?

DataOrg
Builder

I have a list of server in lookup file and I want to create an alert.
The list of server names in the lookup file(around 90 servers) and I need to pass the value in the main query from the lookup file.

The column server has a value with around 90servers so I need to pass the 90 servers values in the search.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

index=foo [| inputlookup yourlookup.csv OUTPUTNEW hostFieldFromLookup AS host | fields host | format host]

Which will turn into

index=foo (host=hostname1 OR host=hostname2 OR ...)

View solution in original post

0 Karma

493669
Super Champion

if lookup file is already created in splunk then use

...|inputlookup <filename>
0 Karma

DataOrg
Builder

it will not work.

i need to read the lookup file and pass the value to sub-search

0 Karma

493669
Super Champion

have you created lookup file in splunk? what is the name of lookup file?

0 Karma

DataOrg
Builder

i am using below search

|inputlookup production_sites where Type="Data"|fields Type|format|table search|mvexpand search | stats count by search|rename search as R|map search="search index="perfmo" host=\"$R$\" source="Perfmon" sourcetype="Physical_Disk" counter="sec/Read" (instance="*G:" OR instance="*J:")"

0 Karma

493669
Super Champion

can you share sample values of lookup

|inputlookup production_sites

check if this above query gives output

|inputlookup production_sites where Type="Data"|fields Type

this query only give Type="data" as field I don't hink if thats you are looking for
as fields command limits the output to show only specific fields in this case as Type

0 Karma

jkat54
SplunkTrust
SplunkTrust

index=foo [| inputlookup yourlookup.csv OUTPUTNEW hostFieldFromLookup AS host | fields host | format host]

Which will turn into

index=foo (host=hostname1 OR host=hostname2 OR ...)

0 Karma

DataOrg
Builder

i need to get a data from lookup file and have to pass it in same query of the sub search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...