Splunk Search

How to write lookup to include Non-Matches?

fzuazo
Path Finder

Greetings,

I have a query I'm working on using tstats and lookup.

My lookup is named hosts_sites and has two columns, hosts and site.

My sample query is below;

 

 

| tstats latest(_time) as latest where index=main by host
| lookup hosts_sites hosts as host OUTPUT site
| table host, site, latest

 

 

How can I make sure that my table includes non-matches. I want to make sure that hosts in the lookup that were not matched are included in the table so they can be addressed/remediated

Labels (2)
0 Karma

somesoni2
Revered Legend

Try like this

| tstats latest(_time) as latest where index=main by host
| append [| inputlookup hosts_sites | table host site ]
| stats values(site) as site values(latest) as latest by host
| table host, site, latest
0 Karma

fzuazo
Path Finder

Thanks for this, I will give it a shot !

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Does your query not list non-matches?  lookup command does not filter out any event so non-matches should be already included.

0 Karma

fzuazo
Path Finder

Unfortunately, not.

If there is a hostname in my lookup table that does not have a corresponding value in the indexed events it will not show up in my results.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...