I have a task to list out some hosts that do not receive logs in Splunk for X hours. Initially it works fine if I define the host in the search.
| metadata type=hosts | search host=*xyz | eval since=now()-lastTime | search since>36 | rename lastTime as "Last Event"| fieldformat "Last Event"=strftime('Last Event', "%c") | table host,"Last Event",since
However, if I want to use a lookup table with host, it does not work. The lookup table "useful_host.csv" contains single columns with hostname as following.
useful_machines
xyz
abc
def
I only want to use the lookup table instead of writing the search like this:
| metadata type=hosts | search host=xyz or host=abc or host=def |...
I searched many similar answers, but none of them work for me.
Try this
| metadata type=hosts | search [| inputlookup useful_host.csv | rename useful_machines as host ]| eval since=now()-lastTime | search since>36 | rename lastTime as "Last Event"| fieldformat "Last Event"=strftime('Last Event', "%c") | table host,"Last Event",since
Try this
| metadata type=hosts | search [| inputlookup useful_host.csv | rename useful_machines as host ]| eval since=now()-lastTime | search since>36 | rename lastTime as "Last Event"| fieldformat "Last Event"=strftime('Last Event', "%c") | table host,"Last Event",since
Thanks a lot and it works perfectly