Splunk Search

Result of two different search

aalaa
Path Finder

Hello ,

i have a csv file that contains the list of all existing services, and i have a search already created that gives the active services now, so i need a search that gives me the name of service not active (missing in search result of active services) ==> so how to compare the csv file contents and the active service result to extract the non-active services ?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!

 index=my_index
 | eval service=lower(service)
 | stats count BY service
 | append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
 | stats sum(count) AS Total BY service
 | where Total=0

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!

 index=my_index
 | eval service=lower(service)
 | stats count BY service
 | append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
 | stats sum(count) AS Total BY service
 | where Total=0

Bye.
Giuseppe

aalaa
Path Finder

Hi ,

it doesn't work for me , i need another proposition please

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...