Splunk Search

How can I enrich my search results with an inputlookup?

renems
Communicator

I'm having a really hard time figuring this one out. How can I enrich my search results with an inputlookup?

In this search I can show all hosts that do have a filesystem for a specific process, but don't have that process running:

index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host

I also created an outputlookup (cpu.csv), showing 3 fields: host, cpu-count, and cpu-type.

Now, I would really like to enrich the first search, with the specs from the cpu's, resulting in host (from first search), cpu-count and cpu-type (from inputlookup).

Thank you in advance!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

 index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host | lookup cpu.csv host

Assuming cpu.csv is set as lookup table and its scope/permissions have been setup correctly to be accessible here.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...