Splunk Search

Match on 2 csv and index and return stats

Observer

Hello, 

GOAL: determine if application server has logged based on a list of application ID codes

I have 2 csv lookups 

Applicationlist.csv   - contains: appID , appNAME

Applicationlist.csv is a subset of all applications listed in Applicationmetadata.csv.

appIDappName
5application_five
24application_twentyfour
35application_thrityfive
120application_onehundtwnty

 

 

Applicationmetadata.csv - contains: applicationID, applicationcode, appServerhostname , appServerIP, 

applicationIDapplicationcodeappServerhostnameappServerIP 
1app1webapp101 1.2.3.101 
1app1webapp11.2.3.1 
2app2sql461.2.4.5 
5app5sql234 1.2.5.67 
5app5apach321.2.5.6 
24app24webapp981.2.5.98 
29app29sql6781.4.5.6 
35app35webapp351.7.8.99 
35app35sql9091.7.8.9 
120app120rsatsl1.8.9.0 

*appID = applicationID. same data, different field name in each csv

* each applciation ususlly has more than 1 server 

The index being refereed to collects not appserver logs, but server logging data. For example, the original index that the appserver logged to. 

Desired results: 

 ..... appmetadata, index(es)/sourcetype(s), Sorted by appID

appIDappNAME appServerhostnameoriginal_indexoriginal_sourcetype 
5app_5hostname_5index1sourcetype_a 
24app_24hostname_24index9sourcetype_x 
35app_35hostname_35index11sourcetype_z 
120 app_120hostname_120index2sourcetype_b 

* original_index and original_sourcetype are fields in the index that are linked  to appServerhostname.

Thanks in advance for your help. 

 

Labels (2)
Tags (2)
0 Karma