Splunk Search

How to use a lookup to compare multiple fields


I am trying to run a search from amazon.

index=amazon-aws sourcetype="aws:description" source="*:ec2_instances" 

When we assign tags via AWS, each tag is shown as a field.

Example tags, Name would be the field and the value would be the friendly name we assign to the server.

We require our engineers to apply 8 specific tags. I am trying to use a lookup table to compare with my search and return only the instances that are missing one of the 8 tags.

The CSV is tags.csv the field in the CSV is development_ec2.

0 Karma

 index=amazon-aws sourcetype="aws:description" source="*:ec2_instances"  | lookup  tags.csv development_ec2 as  field | where isnull(server)
0 Karma


I am still having problems with this search. The above, still returns every instance, not just the ones that are missing tags. Server isnt a field name that AWS add on returns. I am not sure which field to leverage to make this work. I tried several and there was either no results are all servers returned. Apologies as I am very new to SPL and trying to absorb a lot of information quickly.


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...