inputlookup loops

[synsoc]

The idea is my hosts will write a status message to a log file that gets picked up by Splunk and put into a shared index with all others servers. I then want to go through a list of servers via an inputlookup to see when the last time they reported their status was. I can get the time diff to work, but I can't find a way to go through all my servers ie like a for loop. Any suggestions?

input.csv:
ServerName,Environment,App
serverA,Prod,database
serverB,Dev,webserver

base search:
index="server_health" "pulse_detected" | head 1 | eval tnow = now() | eval timediff = (tnow - _time)| eval timediff = timediff/60/60| convert ctime(tnow) |table _time,tnow,timediff

I've tried various versions of this below and just can't wrap my head around how it should work 😞

|indexlookup server.csv | table Server [ index="server_health" "pulse_detected" | head 1 | eval tnow = now() | eval timediff = (tnow - _time)| eval timediff = timediff/60/60| convert ctime(tnow) |table _time,tnow,timediff} ]

[somesoni2 · Accepted solution]

Try like this (assuming your logs have field called Server which matching the lookup's field ServerName)

index="server_health" "pulse_detected"  [| inputlookup server.csv | table ServerName | rename ServerName as Server ]
| dedup Server |  eval tnow = now() | eval timediff = (tnow - _time)| eval timediff = timediff/60/60| convert ctime(tnow) |table _time,tnow,timediff
| append [| inputlookup server.csv  | rename ServerName as Server ]
| stats values(_time) as _time values(tnow) as tnow values(timediff) as timediff values(Environment) as Environment ,values(App) as App   by Server

[synsoc]

Just needed to add ,server below and it worked perfectly. Thanks!

|table _time,tnow,timediff,server