Splunk Search

Table command does not display field with spaces when used with INPUTLOOKUP

neerajs_81
Path Finder

Hello All,
I have a search query that performs lookups against a CSV file and outputs only those hosts that are in the CSV file.
The CSV file has the following 4 columns and notice the IP Address column has a white space in it.
neerajs_81_0-1632911646690.png

I have verified the following command displays the values correctly of all hosts with their IP in a table

 

 

 

| inputlookup linux_servers.csv | table host "IP Address"

 

 

 

Now, if put the same thing  in a  tstats command, it does not show any results.  Any ideas why does it not take "IP Address" even though i have stated double quotes ?? 

 

 

 

| tstats max(_time) as lastSeen_epoch WHERE index=linux [| inputlookup linux_servers.csv |  table host "IP Address" ] by host

 

 

 

The following search works fine , if i take out the "IP Address" . It displays the table with host column.

 

 

 

| tstats max(_time) as lastSeen_epoch WHERE index=linux [| inputlookup linux_servers.csv |  table host ] by host

 

 

 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When troubleshooting a query containing a subsearch, it helps to run the subsearch by itself with the | format command appended.  This will show exactly what is added to the main search.

| inputlookup linux_servers.csv |  table host "IP Address" | format

You'll find the main search ends up looking something like this

| tstats max(_time) as lastSeen_epoch WHERE index=linux ((host=foo AND "IP Address"=1.1.1.1) OR (host=bar AND "IP Address"=1.2.3.4)) by host

Make sure that final query string makes sense with your data.

What you're more likely running into, however, is one of the fields in the tstats command is not indexed and so it is not found.  The "IP Address" field is the most likely candidate.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When troubleshooting a query containing a subsearch, it helps to run the subsearch by itself with the | format command appended.  This will show exactly what is added to the main search.

| inputlookup linux_servers.csv |  table host "IP Address" | format

You'll find the main search ends up looking something like this

| tstats max(_time) as lastSeen_epoch WHERE index=linux ((host=foo AND "IP Address"=1.1.1.1) OR (host=bar AND "IP Address"=1.2.3.4)) by host

Make sure that final query string makes sense with your data.

What you're more likely running into, however, is one of the fields in the tstats command is not indexed and so it is not found.  The "IP Address" field is the most likely candidate.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

neerajs_81
Path Finder

You are right.  Very basic mistake to forget that "IP Address" field is not indexed .  Tstats would never find this field.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!