Splunk Search

subtract csv results by metadata source

gnoellbn
Explorer

I'm trying to subtract the list of host contains in my csv file in field "clients_supprimes" to results of host not reporting to Splunk through a search in the metadata.

So normally I would do something like this :

| metadata hosts NOT [search source="/opt/splunk/sources_manuelles/suppression_client.csv" | table clients_supprimes] | ...

But that doesn't work, same thing if I put the search before the first pipe because metadata has to be first in the search.

Would you have any idea ?

Tags (2)
0 Karma

donnymcbride
New Member

What is the typo? What is the correct search that works?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try following

|metadata type=hosts index=* | search NOT [search source="/opt/splunk/sources_manuelles/suppression_client.csv" | table clients_supprimes | rename clients_supprimes as host]

Also, if the file suppression_client.csv is static and doesn't change often, consider making it as lookup table file.

donnymcbride
New Member

Please identify typo and the search that is correct and works

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Sorry there was a typo. Corrected it. Its seems to be working fine for me (tested with a csv file of my own).

When you want to run the subsearch standalone, you don't need the keyword "search" to be prefixed. Its only required when using subsearch.

0 Karma

gnoellbn
Explorer

It doesn't seem to work, it seems like it's because of the "[search". It returns "No matching field exist"
If I do a standalone search I need to remove it for it to work but if I do in the subsearch it gives me an error.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...