I cant seem to get my inputlookup setup correctly when I try to do a join on a field called module from syslog and a field called serialno from a correctly configured lookup called syslookup
sourcetype="syslog" module=* | eval serialno=module | lookup syslookup serialno | search serialno=* | table module
There are 20 serial nos
There are 10000 modules
Right now the search above is giving me 10000 modules (instead of 20).
Any idea what I could be wrong here.
You need to "limit" the results from the lookup. Try this:
sourcetype="syslog" module=* |eval serialno=module|join serialno [|inputlookup syslookup|table serialno]|table module
Let's break it down
sourcetype="syslog" module=*
means "find all syslog events that have any value in the module field"
| eval serialno=module
means "in each event, assign the value of module to the serialno field". This will overwrite any existing value of serial no. I am not sure why you are doing this. My guess is that this is part of the problem.
| lookup syslookup serialno
means "use the serialno field (which now contains the value of module) and match it to the serialno field in the lookup, returning the fields from the lookup table" I can't determine what fields are returned from the lookup.
| search serialno=*
means "only keep events that have some value in the serialno field." Since all events at this point will have a serialno field, this can and should be eliminated.
| table module
means "only display the module field."
The following search is probably wrong, but closer to what you want:
sourcetype="syslog" module=* | lookup syslookup module OUTPUT serialno | table module serialno
This assumes that your syslookuptable
provides a mapping of modules to serial numbers.
Finally, in your question you mention inputlookup
, but that is not the command that you are using. What data do you have, and what is the problem that you are trying to solve?
You need to "limit" the results from the lookup. Try this:
sourcetype="syslog" module=* |eval serialno=module|join serialno [|inputlookup syslookup|table serialno]|table module