Splunk Search

Using a value from a lookup table

jravida
Communicator

Hi folks,

I have a lookup table I created that is derived from a saved search, and it counts the computers on the network each day. It is only a single line with the host count (host_count) and the time (search_time) it was done. I want to use that value in an equation, but I am having a hard time invoking it.

I want it to look like:
|stats count by patched_host | eval percent = (1-((host_count - count)/host_count))
So this would show me the percent of hosts patched.

So my question is how to reference the lookup table that only has two values, host_count and time.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your base search  |stats count by patched_host | eval host_count=[|inputlookup dailyhosts.csv | return $host_count]| eval percent = (1-((host_count - count)/host_count))  | fields - host_count

View solution in original post

somesoni2
Revered Legend

Try something like this

your base search  |stats count by patched_host | eval host_count=[|inputlookup dailyhosts.csv | return $host_count]| eval percent = (1-((host_count - count)/host_count))  | fields - host_count

jravida
Communicator

You are a Splunk god. I gave you credit to my boss so he doesn't start thinking I'm smart.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...