Log file validation based on serverhost and source

[ganeshkumarmoha]

Hi Team,
For a business requirement, I need to validate log file generated for last an hour with combination of host and source in below order:

Host	Source
server001	c\:...\logpath1.txt
server002	c\:...\logpath2.txt
server003	c\:...\logpath3.txt
server004	c\:...\logpath4.txt
server005	c\:...\logpath5.txt

I knew, inputlookup keyword is single column based; however, I need it two columns to check the log file. Can you please suggest what is the best to accomplish my requirement?

Thanks in advance!

[gcusello · Accepted solution]

Hi @ganeshkumarmoha 

I suppose that you need to check if you' received events from each host with that source, is it correct?

if this is your requirement and if the source column has a fixed part that you can use for checking (e.g. the file name without path), please tru something like this:

<your_search>
| rex field=source "\\(?<Source>logpath\d*.txt)$"
| rename host AS Host
| stats count BY host Source
| append [ | inputlookup your_lookup.csv | eval count=0 | fields Host Source count ]
| stats sum(count) AS total BY Host Source
| where total=0 

Ciao.

Giuseppe

[gcusello]

Hi @ganeshkumarmoha ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉