Splunk Search

How to use a lookup to validate hosts against metadata

a212830
Champion

Hi,

Is it possible to create a lookup, and then validate that data has been received from each host in the lookup by comparing it againsts metadata?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this should do it.

| inputlookup yourlookup.csv | eval recentTime=0 | append [| metadata type=hosts index=* | table host recentTime ] | stats max(recentTime) as recentTime by host | eval Result=if(recentTime=0,"Not Received","Received") | convert ctime(recentTime)
0 Karma

a212830
Champion

Thanks. Shows data that is "Received", but none that aren't. Should be missing about 30 or so...

My lookup has 195 entries, and this returns 166 events. All of them "received".

0 Karma

a212830
Champion

And, just to be clear, some of these might have never sent events.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Sounds like you have duplicates in your lookup file.

Do this to see:

 | inputlookup yourlookup.csv
 | stats count, dc(host) AS unique_hosts

If count and unique_hosts are not equal then find your duplicates:

 | inputlookup yourlookup.csv
 | stats dc(host) AS unique_hosts by host
 | where host>1
0 Karma

HiroshiSatoh
Champion

How about this?
ex.
lookup(my_hosts_list.csv):all
metadata:Match only

| inputlookup my_hosts_list.csv | join type=left host [| metadata type=hosts|eval match="true"|table host match]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...