Splunk Search

metadata used in subsearch

splunkin11
Path Finder

I'm trying to join hosts from a .csv file to the results of this metadata search:
|metadata type=hosts | eval time_diff = now() - lastTime

The .csv file will have some hosts that don't exist in the metadata results but I need to have them show in the final results.
I was thinking a subsearch would work but it fails to match up all the records. I only get about 20 matching records but it does show all records from the .csv.

|inputlookup myfile.csv | fields host | join type=outer host [|metadata type=hosts | eval time_diff = now() - lastTime| table *]

Any suggestions???

0 Karma
1 Solution

sundareshr
Legend

Try this

| inputlookup myfile.csv | fields host | append  [|metadata type=hosts | eval time_diff = now() - lastTime| table *] | stats first(time_diff) as time_diff by host

View solution in original post

0 Karma

vasanthmss
Motivator

Try this,

|inputlookup myfile.csv | fields host | append [|metadata type=hosts |search host=CCFS* | eval time_diff = now() - lastTime| table *] | stats values(*) as * by host
0 Karma

sundareshr
Legend

Try this

| inputlookup myfile.csv | fields host | append  [|metadata type=hosts | eval time_diff = now() - lastTime| table *] | stats first(time_diff) as time_diff by host

View solution in original post

0 Karma

splunkin11
Path Finder

Thanks so much!! That works.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.