Search for hosts in a lookup, but not in Splunk.

[JensT]

Hi,

we have a list of hosts of our inventory. Now we want to find all hosts that are in that list, but are not sending to Splunk.

How can we achieve this?
Splunk 4.3.5

Cheers,

Jens

[MuS · Accepted solution]

Hi JensT

given your lookup table is like this:

cs_host, cs_description
foohost, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called "cs_lookup.csv", the relevant logs have sourcetype "cs_systemlogs" and that the field "cs_host" exists in those log events. In that case, this search should get you going:

| inputlookup cs_lookup.csv | search NOT [search sourcetype="cs_systemlogs" | dedup cs_host | fields cs_host]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS