Splunk Search

Table command does not display field with spaces when used with INPUTLOOKUP

neerajs_81
Builder

Hello All,
I have a search query that performs lookups against a CSV file and outputs only those hosts that are in the CSV file.
The CSV file has the following 4 columns and notice the IP Address column has a white space in it.
neerajs_81_0-1632911646690.png

I have verified the following command displays the values correctly of all hosts with their IP in a table

 

 

 

| inputlookup linux_servers.csv | table host "IP Address"

 

 

 

Now, if put the same thing  in a  tstats command, it does not show any results.  Any ideas why does it not take "IP Address" even though i have stated double quotes ?? 

 

 

 

| tstats max(_time) as lastSeen_epoch WHERE index=linux [| inputlookup linux_servers.csv |  table host "IP Address" ] by host

 

 

 

The following search works fine , if i take out the "IP Address" . It displays the table with host column.

 

 

 

| tstats max(_time) as lastSeen_epoch WHERE index=linux [| inputlookup linux_servers.csv |  table host ] by host

 

 

 

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When troubleshooting a query containing a subsearch, it helps to run the subsearch by itself with the | format command appended.  This will show exactly what is added to the main search.

| inputlookup linux_servers.csv |  table host "IP Address" | format

You'll find the main search ends up looking something like this

| tstats max(_time) as lastSeen_epoch WHERE index=linux ((host=foo AND "IP Address"=1.1.1.1) OR (host=bar AND "IP Address"=1.2.3.4)) by host

Make sure that final query string makes sense with your data.

What you're more likely running into, however, is one of the fields in the tstats command is not indexed and so it is not found.  The "IP Address" field is the most likely candidate.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When troubleshooting a query containing a subsearch, it helps to run the subsearch by itself with the | format command appended.  This will show exactly what is added to the main search.

| inputlookup linux_servers.csv |  table host "IP Address" | format

You'll find the main search ends up looking something like this

| tstats max(_time) as lastSeen_epoch WHERE index=linux ((host=foo AND "IP Address"=1.1.1.1) OR (host=bar AND "IP Address"=1.2.3.4)) by host

Make sure that final query string makes sense with your data.

What you're more likely running into, however, is one of the fields in the tstats command is not indexed and so it is not found.  The "IP Address" field is the most likely candidate.

---
If this reply helps you, Karma would be appreciated.

neerajs_81
Builder

You are right.  Very basic mistake to forget that "IP Address" field is not indexed .  Tstats would never find this field.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...