Hello Everyone and welcome
is there a way to import a csv file to then use it a search parameter to search for events within an index in splunk? I am trying to find the total bill cost of some patients in a hospital but I am only interested in some IDs I have in a CSV file I use this code to find total bill amount
index="rea_host"
search ID=* AND bill_due=*
| stats values(bill_due) by ID
I am trying to use a CVS file named "STATUS" where the ID fields has the name "patient_documentation"
I type:
index="rea_host"
search bill_due=* AND [ lookup STATUS OUTPUT patient_documentation as ID]
| stats values(bill_due) by ID
with no luck, can someone please help me out? thank you so much
Did you tried this?
index="rea_host" bill_due=* [ | inputlookup STATUS OUTPUT patient_documentation as ID | table ID]
| stats values(bill_due) by ID
Thanks
KV
▄︻̷̿┻̿═━一
If this reply helps you, an upvote would be appreciated.
Did you tried this?
index="rea_host" bill_due=* [ | inputlookup STATUS OUTPUT patient_documentation as ID | table ID]
| stats values(bill_due) by ID
Thanks
KV
▄︻̷̿┻̿═━一
If this reply helps you, an upvote would be appreciated.