- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I want to inputlookup a CSV and search the hosts in the CSV to see if they have been reporting into Splunk, and then table a report that will have the host names from the CSV with an added column that displays "yes" or "no". Not sure how I can use the eval statement to do something like eval if count is 0=no if >0=yes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Something like this would get you most of the way there. I think. This would display a table of the host, the last time it reported, and then if it is reporting or not.
| inputlookup servers.csv | join type=left host [|metadata type=hosts ] | table host lastTime | eval reporting=case(isnull(lastTime), "no", 1=1, "yes") | eval time=strftime(lastTime,"%b %d %T %Y %Z") | fields - lastTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You might want to use a case statement instead:
input Lookup search | eval Results =case(count == 0, "Yes", count >= 0, "No")
You can also refer to this quick reference:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Try this:
| inputlookup HostList.csv
| eval count=0
| eval host=upper(host)
| append [
|metasearch index=main latest=-7d
| eval host=upper(host)
| stats count by host
]
| stats sum(count) AS Total by host
| where Total=0
| table host
after you can use eval to show the status or rangemap (see the dashboard example "Table Iconset (Rangemap)" in "Splunk 6.x Dashboard Examples".
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Something like this would get you most of the way there. I think. This would display a table of the host, the last time it reported, and then if it is reporting or not.
| inputlookup servers.csv | join type=left host [|metadata type=hosts ] | table host lastTime | eval reporting=case(isnull(lastTime), "no", 1=1, "yes") | eval time=strftime(lastTime,"%b %d %T %Y %Z") | fields - lastTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

is there a way to format the lastTime field so that it is more human readable?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Definitely, I just modified the search for you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use an eval like that
| eval existing_field=if(count == "0", "No", "Yes")
Another option if the field might exist and might not:
| eval existing_field=if(isnull(field), "No", "Yes")
