Splunk Search

Match on 2 csv and index and return stats

splunkster1
Observer

Hello, 

GOAL: determine if application server has logged based on a list of application ID codes

I have 2 csv lookups 

Applicationlist.csv   - contains: appID , appNAME

Applicationlist.csv is a subset of all applications listed in Applicationmetadata.csv.

appIDappName
5application_five
24application_twentyfour
35application_thrityfive
120application_onehundtwnty

 

 

Applicationmetadata.csv - contains: applicationID, applicationcode, appServerhostname , appServerIP, 

applicationIDapplicationcodeappServerhostnameappServerIP 
1app1webapp101 1.2.3.101 
1app1webapp11.2.3.1 
2app2sql461.2.4.5 
5app5sql234 1.2.5.67 
5app5apach321.2.5.6 
24app24webapp981.2.5.98 
29app29sql6781.4.5.6 
35app35webapp351.7.8.99 
35app35sql9091.7.8.9 
120app120rsatsl1.8.9.0 

*appID = applicationID. same data, different field name in each csv

* each applciation ususlly has more than 1 server 

The index being refereed to collects not appserver logs, but server logging data. For example, the original index that the appserver logged to. 

Desired results: 

 ..... appmetadata, index(es)/sourcetype(s), Sorted by appID

appIDappNAME appServerhostnameoriginal_indexoriginal_sourcetype 
5app_5hostname_5index1sourcetype_a 
24app_24hostname_24index9sourcetype_x 
35app_35hostname_35index11sourcetype_z 
120 app_120hostname_120index2sourcetype_b 

* original_index and original_sourcetype are fields in the index that are linked  to appServerhostname.

Thanks in advance for your help. 

 

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...