Splunk Search

Question about lookups



hopefully someone can give me an advise.

On the one hand I am having a lookup file which contains only simple server names, for instance

Server A
Server B
Server C

From some of them I am having logs, from some of them not. The goal is to create a table which contains all my servers in the lookup file. And then I want to have a another field which contains informations about how often I've got logs from them servers.

Server A   116 Events 
Server B   690 Events
Server C   0 Events

How can I realise this? I only want to see servers from my lookup file, and I also want to see if the server sends zero events.

Thank you very much


Tags (3)
0 Karma


Try this

| inputlookup myserverlookup
| join type=outer host 
    [ search index=_internal sourcetype=splunkd source=*metrics* "group=per_host_thruput"  earliest=-24h
    | stats sum(ev) as events by series 
    | fields - host 
    | rename series as host ]
| join type=outer host [ | metadata type=hosts index=* | fields host lastTime ] 
| fieldformat lastTime = strftime(lastTime,"%x %X") 
| fieldformat events = tostring(events,"commas")
| sort host
| fields host events lastTime

This assumes that your lookup is called myserverlookup and that the field name in the associated csv is host.

This search tries to do things efficiently - instead of looking at all the indexes and counting up all the events - which would take a long time - it uses Splunk's internal metrics to count the events and the last time an event arrived from each host.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!