Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Query against a lookup table
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I have a lookup table of 5groups, is it possible to have SPLUNK query activity against the groups in the lookup table
Lookup table
Group1
Group2
Group3
Group4
Group5
Groups1/3/5 has activity, Group 2/4 has no activity
My logs currently tracks hits each time the group has activity. How do i get splunk to query against the lookup table and show in a report:
Groups with Activity: 3
Groups with no Activity: 2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming your lookup is called MyListOfGroups and has a single field called Group and your event data also has a field called Group and can be returned by a search string represented by EventDataSearchString, like this:
EventDataSearchString | append [|inputlookup MyListOfGroups] | stats count by Group | eval category=if((count=1), "Groups with no Activity", "Groups with activity") | stats count by category
You may have to do some field renaming so that both the file and the events have the same field name (which I called Group).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming your lookup is called MyListOfGroups and has a single field called Group and your event data also has a field called Group and can be returned by a search string represented by EventDataSearchString, like this:
EventDataSearchString | append [|inputlookup MyListOfGroups] | stats count by Group | eval category=if((count=1), "Groups with no Activity", "Groups with activity") | stats count by category
You may have to do some field renaming so that both the file and the events have the same field name (which I called Group).
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
