Splunk Search

How to use inputlookup count of results as a filter for the main search?

sergiupopescu
New Member

So I have a search which pulls the number of servers in a farm that have the "X" application installed on them. Now I have a csv file I do a lookup into, which keeps the server status (Production/Testing/etc).

What I did was:
- to get from the main search a result which counts the number of servers where it is installed
- it displays Application Name | count of servers which have it installed

What I want to do now is to count the number of results from within a lookup and compare the results described above in the main search with this result, if there are differences, I woul like to keep from the main search only the applications which are not installed on the same
number of servers as the inputlookup results.

SO:
Main search:

{blablabla} | stats dc(host) by ApplicationName, Version

Subsearch would be:

| inputlookup *lookup table* | search Destination=*"PROD"* | stats count(host) 

(which in this particular case returns 89)
And I need to compare the number of servers which have the same ApplicationName on them with 89 resulted above

Any help is highly appreciated

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

{blablabla} | stats dc(host) as by ApplicationName, Version | eval ServerCountLookup=[ | inputlookup lookup table | search Destination="PROD" | stats count(host) as count | return $count] | your comparison here...

View solution in original post

somesoni2
Revered Legend

Try something like this

{blablabla} | stats dc(host) as by ApplicationName, Version | eval ServerCountLookup=[ | inputlookup lookup table | search Destination="PROD" | stats count(host) as count | return $count] | your comparison here...

sergiupopescu
New Member

Works perfect, thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...