Search to find missing data using lookup table with multiple fields

[GersonGarcia]

Hello,

I am trying to find missing data in Splunk from a lookup table using inputlookup. My lookup table is:

netdevices_new
netdevice,ip,type
host1,10.10.10.1,router
host2,10.10.10.2,router
host3,10.10.10.3,firewall
host4,10.10.10.4,switch

If I run these searches they work just fine:

For hostnames:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | dedup netdevice | fields netdevice ]

For IPs:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | dedup ip | fields ip ]

How can I search for both netdevice and ip at the same time?

The events in in the network index can have both hostname and ips.

Thank you,

Gerson Garcia

[chimell]

HI
try this search code

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" |stats count by  ip netdevice| dedup ip netdevice | fields ip netdevice ]

[GersonGarcia]

When I run:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P< c >[^ ]+)" | stats c by netdevice, ip | fields - c ]

The output is all hosts in the lookup file.

I think this is what you meant since the < c > after ?P was truncated.

Thank you,

[vasanthmss]

Try this

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | stats c by netdevice, ip | fields - c ]

If you don't have both fields ip netdevice change your rex accordingly. Idea here is you need to pass both the field combination to search.

If your lookup doesn't have all the possible combination you need to write another subsearch