Splunk Search

inputlookup with matching events

riqbal47010
Path Finder

I have one lookup file. Now I want to see the list of servers that are in the list but not in AV index.

Tags (1)
0 Karma

jacobpevans
Motivator

Greetings @riqbal47010,

Try this (ensuring you have the time option set properly):

| inputlookup lookup.csv
| join type=left max=0 host [
    | index=AV sourcetype=[sourcetype]
    | stats count by host ]
| where isnull(count)

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...