Hello everyone, I'd like to start out by saying I'm really quite new to Splunk, and we run older versions(6.6.3 and 7.2.3). I'm looking to have a search that will do the following: - Look up the c...
See more...
Hello everyone, I'd like to start out by saying I'm really quite new to Splunk, and we run older versions(6.6.3 and 7.2.3). I'm looking to have a search that will do the following: - Look up the current hosts in our system, which I can get with the following search index=* "daily.cvd"
| dedup host | table host - Then compare to a CSV file that has 1 column with A1 being "host" and then all other entries are the hosts that SHOULD be present/accounted for. -- Using ChatGPT I was able to get something like below which on it's own will properly read the CSV file and output the hosts in it. | append [
| inputlookup hosts.csv
| rename host as known_hosts
| stats values(known_hosts) as known_hosts
]
| eval source="current"
| eval status=if(isnull(mvfind(known_hosts, current_hosts)), "New", "Existing")
| eval status=if(isnull(mvfind(current_hosts, known_hosts)), "Missing", status)
| mvexpand current_hosts
| mvexpand known_hosts
| table current_hosts, known_hosts, status - However when I combine the 2, it will show me 118 results(should only be 59) and there are no results in the "current_hosts" column, and after 59 blank results, the "known_hosts" will then show the correct results from the CSV. index=* "daily.cvd"
| dedup host | table host
| append [
| inputlookup hosts.csv
| rename host as known_hosts
| stats values(known_hosts) as known_hosts
]
| eval source="current"
| eval status=if(isnull(mvfind(known_hosts, current_hosts)), "New", "Existing")
| eval status=if(isnull(mvfind(current_hosts, known_hosts)), "Missing", status)
| mvexpand current_hosts
| mvexpand known_hosts
| table current_hosts, known_hosts, status I'd love to have any help on this, I'm wouldn't be surprised if ChatGPT is making things more difficult than needed. Thanks in advance!