Splunk Search

Search to find missing data using lookup table with multiple fields

GersonGarcia
Path Finder

Hello,

I am trying to find missing data in Splunk from a lookup table using inputlookup. My lookup table is:

netdevices_new
netdevice,ip,type
host1,10.10.10.1,router
host2,10.10.10.2,router
host3,10.10.10.3,firewall
host4,10.10.10.4,switch

If I run these searches they work just fine:

For hostnames:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | dedup netdevice | fields netdevice ]

For IPs:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | dedup ip | fields ip ]

How can I search for both netdevice and ip at the same time?

The events in in the network index can have both hostname and ips.

Thank you,

Gerson Garcia

0 Karma

chimell
Motivator

HI
try this search code

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" |stats count by  ip netdevice| dedup ip netdevice | fields ip netdevice ]
0 Karma

GersonGarcia
Path Finder

When I run:

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P< c >[^ ]+)" | stats c by netdevice, ip | fields - c ]

The output is all hosts in the lookup file.

I think this is what you meant since the < c > after ?P was truncated.

Thank you,

0 Karma

vasanthmss
Motivator

Try this

| inputlookup netdevices_new | search NOT [search index=network | rex field=_raw "^(?:[^ \n]* ){4}(?P[^ ]+)" | stats c by netdevice, ip | fields - c ]

If you don't have both fields ip netdevice change your rex accordingly. Idea here is you need to pass both the field combination to search.

If your lookup doesn't have all the possible combination you need to write another subsearch

V
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...