Splunk Search

Using a value from a lookup table

jravida
Communicator

Hi folks,

I have a lookup table I created that is derived from a saved search, and it counts the computers on the network each day. It is only a single line with the host count (host_count) and the time (search_time) it was done. I want to use that value in an equation, but I am having a hard time invoking it.

I want it to look like:
|stats count by patched_host | eval percent = (1-((host_count - count)/host_count))
So this would show me the percent of hosts patched.

So my question is how to reference the lookup table that only has two values, host_count and time.

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your base search  |stats count by patched_host | eval host_count=[|inputlookup dailyhosts.csv | return $host_count]| eval percent = (1-((host_count - count)/host_count))  | fields - host_count

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your base search  |stats count by patched_host | eval host_count=[|inputlookup dailyhosts.csv | return $host_count]| eval percent = (1-((host_count - count)/host_count))  | fields - host_count

jravida
Communicator

You are a Splunk god. I gave you credit to my boss so he doesn't start thinking I'm smart.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...