Splunk Search

Lookup error

splunkn
Communicator

We are collecting log files from various components servers.
Eg. Collecting logs from 3 hosts application A [ This is the lookup I have used]
Host1 /app/sdf ; /app/cdf ; /app/ghf
Host2 /app/sdf ; /app/cdf ; /app/ghf
Host3 /app/sdf ; /app/cdf ; /app/ghf ; /app/wer/* [ie. /app/wer/1.log,/app/wer/2.log, /app/wer/2.log, so on]

For unique logs I have no problem I got the query through this,

index=* appid=$appid$ host=$host$ |rename comment as $earliest$ | stats count by host,source | eval type="current" | table host,source,type | append [|inputlookup source.csv | search appid=$appid$ | search host=$host$ | makemv delim=";" source | eval type="existing" | table appid,host,source,type] | stats values(type) as type by host,source | where mvcount(type) =1 | eval reason=if(type="current","Newlogfile","Missingfile") | table host,reason | search reason="Missingfile"

I am having two dropdowns for inputs appid and host. It goes fine while dealing with unique files
i.e For (/app/sdf ; /app/cdf ; /app/ghf ) it matches correctly and return the results.
But for logs using wildcard, Im confused 😞 [/app/wer/]
How to match (/app/wer/
) with lookup values?

Kindly suggest some solutions

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The error suggests your lookup is all input fields and no output fields, so there'd be nothing for Splunk to do. Make sure you use OUTPUT or OUTPUTNEW to split the input fields from the output fields in your LOOKUP-foo definition.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsfromexternaldatasources#Set_up_...

0 Karma

splunkn
Communicator

Martin, thanks for your response. Still am not getting what I want. I have edited the question now
Could you please suggest? Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...