Splunk Search

Result of two different search

aalaa
Path Finder

Hello ,

i have a csv file that contains the list of all existing services, and i have a search already created that gives the active services now, so i need a search that gives me the name of service not active (missing in search result of active services) ==> so how to compare the csv file contents and the active service result to extract the non-active services ?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!

 index=my_index
 | eval service=lower(service)
 | stats count BY service
 | append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
 | stats sum(count) AS Total BY service
 | where Total=0

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!

 index=my_index
 | eval service=lower(service)
 | stats count BY service
 | append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
 | stats sum(count) AS Total BY service
 | where Total=0

Bye.
Giuseppe

aalaa
Path Finder

Hi ,

it doesn't work for me , i need another proposition please

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...