Lookup matching question

[jip31]

Hi,
I used the code below.
In a first version of the code, my code began by | inputlookup append=t NZDL.csv
And after there was a lot of | join type=outer host [search index
The code was running but very slowly

So I did the new request below :

 (index="perfmon" sourcetype="winhostmon")
OR (index="windows-wmi" sourcetype="WMI:LastLogon") 
OR (index="windows-wmi" sourcetype="WMI:LastReboot" LastBootUpTime) 
OR (index="windows-wmi" sourcetype="wmi:MemorySize") 
OR (index="windows-wmi" sourcetype="WMI:PeriphIssue" Caption=Mobile ConfigManagerErrorCode)  
OR (index="windows-wmi" sourcetype="WMI:MonitorSN" SerialNumberID)
OR (index=windows sourcetype=winregistry earliest=-120d 
key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry" OR 
key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\WindowsVersion" OR 
key_path="\\registry\\machine\\software\\microsoft\\windows nt\\currentversion\\ReleaseId" OR 
key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\PatchLevel") 
OR (index=windows sourcetype=tools:flags filename=*ABDM-TOUPDATE*) 

| lookup VideoSignalStatus.csv ConfigManagerErrorCode 

| eval TotalSpace =  TotalSpaceKB/1024
| eval FreeSpace = FreeSpaceKB/1024
| eval FreeSpace = round(FreeSpace/1024,1)
| eval TotalSpace = round(TotalSpace/1024,1)
| eval FreePerc = round((FreeSpace/TotalSpace)*100,1)
| eval DiskSpace = TotalSpace." GB". " (Total) ". FreeSpace." GB". " (Free) ". FreePerc." %". " (Free %) "

| rex field=LastLogon mode=sed "s/\..*$$//" 
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")

| rex field=LastBootUpTime mode=sed "s/\..*$$//" 
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")

| eval MemorySize =round(TotalPhysicalMemory/1024000000, 0). " GB"

| eval OS=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\WindowsVersion",data, null), 
NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data,null), 
Build=if(key_path=="\\registry\\machine\\software\\microsoft\\windows nt\\currentversion\\ReleaseId",data,null), 
Patch=if(key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\PatchLevel",data,null) 

| eval filename=if(filename=="ABDM-TOUPDATE.$$w$$", "YES", null) 

| stats first(DiskSpace) as DiskSpace latest(LastLogon) as LastLogon latest(FreePerc) as FreePerc latest(LastBootUpTime) as LastReboot latest(MemorySize) as MemorySize latest(Meaning) as ScreenSignal latest(filename) as StayAwake latest(SerialNumberID) as VideoSN latest(Patch) as Patch values(NATCO) as NATCO values(OS) as OS values(Build) as Build  by host

| lookup NZDL.csv host OUTPUT Building, Floor, Gate, Ping

| eval Ping =if(Ping=="True","OK","KO") 

| eval StayAwake=if(isnotnull(StayAwake),StayAwake,"No")

| table host Building Floor Gate Ping DiskSpace FreePerc MemorySize LastLogon LastReboot ScreenSignal VideoSN StayAwake Patch NATCO OS Build

I just need a confirmation about this code.

Could you confirm to me that there is a match between the “host” field in my CSV and the SPLUNK “host” field?
As I work actually in local, I am unable to confirm that the match with the field “host” works fine.

Other question :
Is it possible to do this?

(index="perfmon" sourcetype="winhostmon")
OR (index="windows-wmi" sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot" LastBootUpTime OR sourcetype="wmi:MemorySize" OR sourcetype="WMI:PeriphIssue" Caption=Mobile ConfigManagerErrorCode OR sourcetype="WMI:MonitorSN" SerialNumberID) OR (index=windows sourcetype=winregistry earliest=-120d 
key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry" OR 
key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\WindowsVersion" OR 
key_path="\\registry\\machine\\software\\microsoft\\windows nt\\currentversion\\ReleaseId" OR 
key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\PatchLevel") 
OR (index=windows sourcetype=tools:flags filename=*ABDM-TOUPDATE*) 

Thanks

[Shan]

@jip31,

Could you confirm to me that there is a match between the “host” field in my CSV and the SPLUNK “host” field?
As I work actually in local, I am unable to confirm that the match with the field “host” works fine.

For above question. With out sample data we cannot say exactly whether your host field value in lookup and index are matching or not. But based on the query, i can say if matching data is there in index and lookup for sure above query will fetch the data.

(index="perfmon" sourcetype="winhostmon")
 OR (index="windows-wmi" sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot" LastBootUpTime OR sourcetype="wmi:MemorySize" OR sourcetype="WMI:PeriphIssue" Caption=Mobile ConfigManagerErrorCode OR sourcetype="WMI:MonitorSN" SerialNumberID) OR (index=windows sourcetype=winregistry earliest=-120d 
 key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry" OR 
 key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\WindowsVersion" OR 
 key_path="\\registry\\machine\\software\\microsoft\\windows nt\\currentversion\\ReleaseId" OR 
 key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\PatchLevel") 
 OR (index=windows sourcetype=tools:flags filename=*ABDM-TOUPDATE*) 

Above query will work. But it will be slow.