Splunk Search

Search help ?

splunker969
Communicator

When Iam trying to run this search its giving me wrong results .Please correct my search. In my csv is having to coumlmns one is host and other H=YES . Thanks

| metadata type=hosts index=*
| join [| inputlookup watchlist1.csv |search H=YES| rename Host as host]
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host
| sort lastTime
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount

Tags (2)
0 Karma

elliotproebstel
Champion

Are you trying to filter the results of the metadata query to only show hosts from your lookup file that contain YES in the H field? If so, give this a shot:

| metadata type=hosts index=* 
| search 
 [| inputlookup watchlist1.csv 
 |search H="YES"
 | rename Host as host
 | fields host ] 
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host 
| sort lastTime 
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount 

splunker969
Communicator

Hi ellitproebstel ,

Thanks :)Search is working can you help me to find the fully qualified name for host when i search its giving me host name in short cut .

0 Karma

elliotproebstel
Champion

Do you have the fully qualified name somewhere in your logs or in a lookup?

0 Karma

splunker969
Communicator

logs are having names

0 Karma

splunker969
Communicator

In csv better we need to keep host names as below i got results but in more hosts than csv file .

    host     H
     YY*      YES
      XX*      YES
0 Karma

splunker969
Communicator

Hi Mate,

As we are getting the duplicate results from the csv table and the results are coming with both normal host name and hostname with FQDNS. How do we resolve this and please suggest.

Example:
host
host.com

Thanks.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...