Splunk Search

Search for hosts in a lookup, but not in Splunk.

JensT
Communicator

Hi,

we have a list of hosts of our inventory. Now we want to find all hosts that are in that list, but are not sending to Splunk.

How can we achieve this?
Splunk 4.3.5

Cheers,

Jens

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi JensT

given your lookup table is like this:

cs_host, cs_description
foohost, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called "cs_lookup.csv", the relevant logs have sourcetype "cs_systemlogs" and that the field "cs_host" exists in those log events. In that case, this search should get you going:

| inputlookup cs_lookup.csv | search NOT [search sourcetype="cs_systemlogs" | dedup cs_host | fields cs_host]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi JensT

given your lookup table is like this:

cs_host, cs_description
foohost, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called "cs_lookup.csv", the relevant logs have sourcetype "cs_systemlogs" and that the field "cs_host" exists in those log events. In that case, this search should get you going:

| inputlookup cs_lookup.csv | search NOT [search sourcetype="cs_systemlogs" | dedup cs_host | fields cs_host]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...