Splunk Search

tstats and inputlookup case sensitive problem

Builder

We had problem this week with logs indexed with lower or upper case hostnames. We run this query in a scheduled macro :

It seems that our eval functions don't do the job.

Query attached.

Thanks.

link text

0 Karma
1 Solution

Builder

Solved by adding after tstats :

| eval host = lower(host) | stats max(latest) as latest,min(earliest) as earliest by host source

View solution in original post

0 Karma

Builder

Solved by adding after tstats :

| eval host = lower(host) | stats max(latest) as latest,min(earliest) as earliest by host source

View solution in original post

0 Karma

Builder

The problem is with tstats which is case sensitive, I haven't problem with stats but it's very slow.

0 Karma

Revered Legend

Assuming your lookup table has host names in lower case, but indexed data has various case, try this

| tstats latest(_time) as latest,earliest(_time) as earliest WHERE index = * by host source | eval host=lower(host) | search [| inputlookup liste_serv |  eval host = host+"*"  | eval source=split(logsSystem, "#") | mvexpand source | table host source] | eval host = lower(replace(host,".production.com","")) | eval timeNow=relative_time( now(), "-8h@h") | where latest<timeNow | eval last=strftime(latest, "%Y-%m-%d %T") | eval first=strftime(earliest, "%Y-%m-%d %T") | sort - last | stats list(source) as source list(last) as "lastApparition" list(latest) as latest list(count) as count by host
0 Karma

Builder

Thanks somesoni2 however we already tried it by adding | eval host=lower(host) before inputlookup 😞

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!