Re: inputlookup with matching events

riqbal47010 · ‎10-16-2019

I have one lookup file. Now I want to see the list of servers that are in the list but not in AV index.

jacobpevans · ‎10-16-2019

Greetings @riqbal47010,

Try this (ensuring you have the time option set properly):

| inputlookup lookup.csv
| join type=left max=0 host [
    | index=AV sourcetype=[sourcetype]
    | stats count by host ]
| where isnull(count)

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

inputlookup with matching events

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Are you a member of the Splunk Community?

inputlookup with matching events

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions