Using a value from a lookup table

[jravida]

Hi folks,

I have a lookup table I created that is derived from a saved search, and it counts the computers on the network each day. It is only a single line with the host count (host_count) and the time (search_time) it was done. I want to use that value in an equation, but I am having a hard time invoking it.

I want it to look like:
|stats count by patched_host | eval percent = (1-((host_count - count)/host_count))
So this would show me the percent of hosts patched.

So my question is how to reference the lookup table that only has two values, host_count and time.

[somesoni2 · Accepted solution]

Try something like this

your base search  |stats count by patched_host | eval host_count=[|inputlookup dailyhosts.csv | return $host_count]| eval percent = (1-((host_count - count)/host_count))  | fields - host_count

[jravida]

You are a Splunk god. I gave you credit to my boss so he doesn't start thinking I'm smart.