Splunk Search

help for retrieving events not found from a lookup list

jip31
Motivator

Hello

I use the search below in order to display the list of HOSTNAME which have a SITE field that matches

 

 

| inputlookup lookup_cmdb 
| search HOSTNAME= aaa
    OR HOSTNAME= bbb
    OR HOSTNAME= ccc
    OR HOSTNAME= dddd
| stats values(SITE) as SITE by HOSTNAME
| table HOSTNAME

 

Instead the host which have a SITE field that matches, I would like to display the host list that have no SITE field

How to do please?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup lookup_cmdb 
| search HOSTNAME= aaa
    OR HOSTNAME= bbb
    OR HOSTNAME= ccc
    OR HOSTNAME= dddd
| search NOT SITE="*"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup lookup_cmdb 
| search HOSTNAME= aaa
    OR HOSTNAME= bbb
    OR HOSTNAME= ccc
    OR HOSTNAME= dddd
| where isnull(SITE)
0 Karma

jip31
Motivator

I have already tested it but like this I have no results......

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup lookup_cmdb 
| search HOSTNAME= aaa
    OR HOSTNAME= bbb
    OR HOSTNAME= ccc
    OR HOSTNAME= dddd
| where isnull(SITE) OR SITE=""
0 Karma

jip31
Motivator

@ITWhisperer wrote:

 

| inputlookup lookup_cmdb 
| search HOSTNAME= aaa
    OR HOSTNAME= bbb
    OR HOSTNAME= ccc
    OR HOSTNAME= dddd
| where isnull(SITE) OR SITE=""

 


no results too...

Tags (1)
0 Karma

jip31
Motivator

| where isnotnull(SITE) works but not | where isnull(SITE)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup lookup_cmdb 
| search HOSTNAME= aaa
    OR HOSTNAME= bbb
    OR HOSTNAME= ccc
    OR HOSTNAME= dddd
| search NOT SITE="*"
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...