How to search to retrieve the host values from the index data that match the host values in the CSV file?

[satyaallaparthi]

I have an index named "Linux" and a CSV file called "sample.csv" with multiple columns, including "IP" and "Host."

My objective is to retrieve the host values from the index data that match the host values in the CSV file.

In the index data, the host values encompass not only host names but also IP addresses and hosts with DNS information. Conversely, the host values in the CSV file solely consist of host names. I need to utilize the "mvappend" function for ip and host, which is fine) 

However, my concern pertains to obtaining results that match the host values in the CSV file, similar to the way we construct search queries. For instance, if we were to search "index=linux host1 OR host2," it would return values that match the host names in the raw data, such as "host1.dns.com" and so on. Yet, when matching with the CSV file, it searches for the entire host name in the file.

[ITWhisperer]

index=linux [|inputlookup nost.csv | rename host as query | table query | dedup query]

[satyaallaparthi]

Won’t it look for whole string value inside the lookup? because I tried but not returning all the values, however when I search the csv value individually, I am getting the result (note: I used |format aswell at the end)

for ex: if I have a value called “host1” in indexed data and host1.example.com in csv file or viceversa. 

[ITWhisperer]

If you have host1 in the data and host1.example.com in the csv, then it wouldn't find it. If it is the other way around, then it should find it.

Please clarify your requirement.

[satyaallaparthi]

I have both. For few hosts, I have dns along with host name in the indexed data and so for csv too. 

for ex: 1 to 5 servers have dns in indexed data (some host names are ip address) and 6 to 10 have dns in csv. 

[ITWhisperer]

index=linux [|inputlookup host.csv | rename host as query | table query | dedup query | format] OR [|inputlookup host.csv | rename ip as query | table query | dedup query | format]

[satyaallaparthi]

I have a hostname + dns in indexed data but only the hostname in csv file. 

when I am running the subsearch and using the "|format".. Splunk is just search for the particular keyword as host = "test1server" but not "*test1server*", which I am not getting any results because of not adding the "*" before and after. 

That's the reason, I raised this here to know, if there is a way to do or add "*" by default to a result in host name

[ITWhisperer · Accepted solution]

| eval query="*".host."*"