Splunk Search

Match on 2 csv and index and return stats

splunkster1
Observer

Hello, 

GOAL: determine if application server has logged based on a list of application ID codes

I have 2 csv lookups 

Applicationlist.csv   - contains: appID , appNAME

Applicationlist.csv is a subset of all applications listed in Applicationmetadata.csv.

appIDappName
5application_five
24application_twentyfour
35application_thrityfive
120application_onehundtwnty

 

 

Applicationmetadata.csv - contains: applicationID, applicationcode, appServerhostname , appServerIP, 

applicationIDapplicationcodeappServerhostnameappServerIP 
1app1webapp101 1.2.3.101 
1app1webapp11.2.3.1 
2app2sql461.2.4.5 
5app5sql234 1.2.5.67 
5app5apach321.2.5.6 
24app24webapp981.2.5.98 
29app29sql6781.4.5.6 
35app35webapp351.7.8.99 
35app35sql9091.7.8.9 
120app120rsatsl1.8.9.0 

*appID = applicationID. same data, different field name in each csv

* each applciation ususlly has more than 1 server 

The index being refereed to collects not appserver logs, but server logging data. For example, the original index that the appserver logged to. 

Desired results: 

 ..... appmetadata, index(es)/sourcetype(s), Sorted by appID

appIDappNAME appServerhostnameoriginal_indexoriginal_sourcetype 
5app_5hostname_5index1sourcetype_a 
24app_24hostname_24index9sourcetype_x 
35app_35hostname_35index11sourcetype_z 
120 app_120hostname_120index2sourcetype_b 

* original_index and original_sourcetype are fields in the index that are linked  to appServerhostname.

Thanks in advance for your help. 

 

Labels (2)
Tags (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...