Splunk Search

multisearch with a lookup and index?

msage
Path Finder

I'm looking to combine data from a lookup file to data from our security server to create a comparison chart between how many alarms we get (security server) and how many of those are acknowledged (lookup file). I figured multisearch was the way to go but I'm getting errors when using it. The search is below. The reason for the eval Date fields are because one column contains dates so I needed to get them in the right order since they were always out. The end goal is a daily chart showing x alarms and y acknowledgements. 

 

| multisearch

    [| inputlookup genericlookupname.csv
| eval Date=strptime(Date,"%m/%d/%Y")
| sort Date
| eval Date=strftime(Date,"%m/%d/%Y")]
    [search index=index EVDESCR="alarm"]

 

 

Labels (2)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @msage,

Try this:

index=<provide_index_name> EVDESCR="alarm" 
| append [ | inputlookup genericlookupname.csv ]
| eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y"))
| stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index!="<provide_index_name>")) as acknowledgements by Date
0 Karma

msage
Path Finder

Hey @manjunathmeti ,

 

I tried this but unfortunately the lookup data always stays at 0. 

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Does genericlookupname.csv has Date field?

Tags (1)
0 Karma

msage
Path Finder

It does yes

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Try this:

index=<provide_index_name> EVDESCR="alarm" 
| append [ | inputlookup genericlookupname.csv | eval index="mycsvdata" ]
| eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y"))
| fields index, Date
| stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index="mycsvdata")) as acknowledgements by Date

 

If this reply helps you, a like would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...