Splunk Search

compare output of a search to a lookup file

aalaa
Path Finder

Hello ,

I have a csv lookup file that contains all Oracle services, at the same time I have a search that gives me the active services now, I need to know what the service is missing in the result of search on comparison by the csv files.

Any help please?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
if the field is called "service" both in index and in lookup, try something like this:

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0

In this way you have al the missing services.

If you want to list all the services displayng status, you have to replace the last row with

| eval Status=if(Total=o,"Missing","Present")
| table service Status

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
if the field is called "service" both in index and in lookup, try something like this:

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0

In this way you have al the missing services.

If you want to list all the services displayng status, you have to replace the last row with

| eval Status=if(Total=o,"Missing","Present")
| table service Status

Bye.
Giuseppe

0 Karma

aalaa
Path Finder

This search return the list of service in the csv file :

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| eval Status=if(Total=o,"Missing","Present")
| table service Status

I want to display the name of service that not actif now

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
to display the list of not active services, you have to use the first choice (the one with | where Total=0 ) because the condition to identify not present services is that these services are in the lookup table (count=0) but not in the index (count>0).
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...