I have an inputlookup called hosts.csv that looks like this:
host
----------
hostname1
hostname2
hostname3
hostname4
I want to list all indexes containing the value of host in raw data against that hostname. So the output I am looking for is...
host index
------------------------------
hostname1 firewall
web
unix
proxy
hostname2 firewall
database
unix
dmz
hostname3 firewall
proxy
hostname4 firewall
proxy
windows
I have tried using the search below which gives me matching indexes containing the hostnames in raw data. But I am not able to create a table to list the hostnames against the indexes.
[|inputlookup hosts.csv|table host|rename host as search|format]|stats values(index)
I tried adding code...|lookup hosts.csv host OUTPUT host| stats values(index) by host
and get no results. Can you please help me obtain the output above?
Thanks!
|tstats count WHERE index=* by host,index| table host index | search [|inputlookup hosts.csv] | stats values(index) by host
I still get No results found.
Yes they match, even though they are part of an fqdn I can see them in raw data when I query for them using ...|rename host as search|format
.
Also splunk produces a list of matching indices when I use the query [|inputlookup hosts.csv|table host|rename host as search|format]|stats values(index)
.
I just am struggling to append the index list with the hostnames from the lookup.
does the host name in your lookup match exactly with the host names in your splunk data?