Splunk Search

inputlookup query table fields

MGlass
Explorer

I am running the current search using the network toolkit but will not show the hostname field from the csv, do I need to do another inputlookup at the end of the search.

| inputlookup iphost.csv
| search src_ipV4=* hostname=*
| rename src_ipV4 as host
| stats values(host) as host
| mvexpand host
| map maxsearches=50 search="| ping host=$host$ count=1 | eval dest=if(isnull(dest),host,dest) | fields host dest received"
| table host dest received hostname

Labels (1)
0 Karma

dtburrows3
Builder

Since you are piping to a map command the final resulting dataset you are presented with are from the inner search of that map command. You should be able to use hostname as a token inside that inner search to get it to show up in the final results.

Something like this.

 

| inputlookup iphost.csv
| search src_ipV4=* hostname=*
| rename src_ipV4 as host
| stats values(host) as host by hostname
| mvexpand host
| map maxsearches=50 search="| ping host=$host$ count=1 | eval dest=if(isnull(dest),host,dest), hostname=\"$hostname$\" | fields host dest received, hostname"
| table host dest received hostname

 

 

0 Karma

MGlass
Explorer

Looks like it works but the received results are the same for each host, I have 7 of  8 servers offline and they all show received responses.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...