Splunk Search

Lookup Configured, Now I Need More Fields...

aferone
Builder

We are comparing a list of policies (uploaded as a lookup, using "policywithdescs") against our firewall data and determining which policies are NOT being used. Anything with a count of 0 shows us which are not being used. We are using the "policy_id" column in the lookup csv:

index="summary" policy_id=* 
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count by policy_id 
| eval count=count-1 
| sort count 

Now, I have added data to the lookup csv, including zone and description information for each policy. This search above shows the "policy_id", then count. How would I add "Zone" and "Description" to each policy_id to the report?

Thanks!

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

if your extra fields are "Zone" "Description"

index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count values(Zone) values(Description) by policy_id
| eval count=count-1
| sort count

View solution in original post

yannK
Splunk Employee
Splunk Employee

if your extra fields are "Zone" "Description"

index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count values(Zone) values(Description) by policy_id
| eval count=count-1
| sort count

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.