Splunk Search

How to use a lookup to validate hosts against metadata

Champion

Hi,

Is it possible to create a lookup, and then validate that data has been received from each host in the lookup by comparing it againsts metadata?

0 Karma

SplunkTrust
SplunkTrust

Something like this should do it.

| inputlookup yourlookup.csv | eval recentTime=0 | append [| metadata type=hosts index=* | table host recentTime ] | stats max(recentTime) as recentTime by host | eval Result=if(recentTime=0,"Not Received","Received") | convert ctime(recentTime)
0 Karma

Champion

Thanks. Shows data that is "Received", but none that aren't. Should be missing about 30 or so...

My lookup has 195 entries, and this returns 166 events. All of them "received".

0 Karma

Champion

And, just to be clear, some of these might have never sent events.

0 Karma

Ultra Champion

Sounds like you have duplicates in your lookup file.

Do this to see:

 | inputlookup yourlookup.csv
 | stats count, dc(host) AS unique_hosts

If count and unique_hosts are not equal then find your duplicates:

 | inputlookup yourlookup.csv
 | stats dc(host) AS unique_hosts by host
 | where host>1
0 Karma

Champion

How about this?
ex.
lookup(myhostslist.csv):all
metadata:Match only

| inputlookup my_hosts_list.csv | join type=left host [| metadata type=hosts|eval match="true"|table host match]
0 Karma