Splunk Search

Can I use wildcards in the lookup csv file to show a list of similar named servers?

martinjnancy
New Member

I'm using a lookup table to further define the type of servers listed in a drop down box. The csv file is manually created, so I would like to use wildcards to specify my search criteria.

From:
hostname,landscape,servertype,org
us6pb1d01,"SAP BW (PB1)",db,ccr_nmon
us6pb1a01,"SAP BW (PB1)",app,ccr_nmon
us6pb1a02,"SAP BW (PB1)",app,ccr_nmon
us6pwmd01,"WebMethods (PWM)",db,ccr_nmon
us6pwmd02,"WebMethods (PWM)",db,ccr_nmon

To:
hostname,landscape,servertype,org
us6pb1d*,"SAP BW (PB1)",db,ccr_nmon
us6pb1a*,"SAP BW (PB1)",app,ccr_nmon
us6pwmd*,"WebMethods (PWM)",db,ccr_nmon

I have the following in my transforms.conf file:

[nmon_serverlookup]
filename = ccr_serverlookup.csv
match_type = WILDCARD(servertype)

However, when I go to select a server, it is listing "us6pwmd*" and not giving a list of servers.

Here are parts of my input criteria:

  <populatingSearch earliest="$timerange.earliest$" latest="$timerange.latest$" fieldForLabel="landscape" fieldForValue="landscape">| inputlookup ccr_serverlookup.csv | fields landscape | dedup landscape | table landscape</populatingSearch>
<input type="dropdown" token="servertype" searchWhenChanged="true">
  <label>Server Type:</label>
  <default>All</default>
  <choice value="*">All</choice>
  <choice value="app">Application</choice>
  <choice value="db">Database</choice>
</input>
<input type="multiselect" token="hostname" searchWhenChanged="true">
  <label>Hosts Selection:</label>
  <populatingSearch earliest="$timerange.earliest$" latest="$timerange.latest$" fieldForLabel="hostname" fieldForValue="hostname">|inputlookup ccr_serverlookup.csv | where landscape="$landscape$" AND servertype="$servertype$" | stats count by hostname | dedup hostname | sort hostname

Any suggestions??

Many thanks!

Tags (2)
0 Karma

vasanthmss
Motivator

is it working?

V
0 Karma

vasanthmss
Motivator

Add * front and back of your token based on your req like server type

inputlookup ccr_serverlookup.csv | where landscape="$landscape$" AND servertype="*$servertype$*" | stats count by hostname | dedup hostname | sort hostname
V
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...