Splunk Search

searchmatch function



I am trying to find an ip from first query and then search that ip if exists in another csv file and show the count of only those ips

| inputlookup asset_list.csv 
| search "Infrastrucure Name"="xyz" | eval main_ip=IP [| inputlookup ip_exist.csv  |  eval test=if(searchmatch("IP=$main_ip$"), "yes", "no") | table IP test | where test="yes" ]

But i am getting error in the eval function.
please help.

Tags (3)
0 Karma




 | inputlookup asset_list.csv |eval source="asset"
 | search "Infrastrucure Name"="xyz" |append [| inputlookup ip_exist.csv|eval source="exist" ]
 | stats count,values(source) as source by IP|where mvcount(source) > 1

If you have different field names for IP in the csv, rename one of them
If you have unique IPs in both files, stats ccount by IP|where count >1 also should work

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!