How to map the lookup conditions and get the indexed data in splunk

[snehalk]

Hello Everyone,

I have requirement where i need to search eventtype which are present in my lookup table, say in lookup i have one column name called "eventtype" and other column "Status" value as pass or Fail

eg:

 eventtype  Status 
    xyz         pass 
   abc          Fail

So in my final result i want the all indexed data with eventtype "xyz"

Below is what i tried but its not working

index=myindex sourcetype=aa  [ | inputlookup myfile.csv where Status ="pass"| table eventtype ] 

Can any one help me on this?

Thanks,
Snehal Kinekar

[woodcock]

In Splunk, eventtypes are a search-time-only construct so what you are asking (something index-time based on eventtypes) is utterly impossible. Perhaps I am being "too literal" and I might have a better/different answer if you rephrased your question.

[martin_mueller]

If you define your lookup to be automatic (Settings -> Lookups -> Automatic Lookups) for that sourcetype inputting eventtype and outputting Status, you will be able to search like this:

index=myindex sourcetype=aa Status=pass

http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usefieldlookupstoaddinformationtoyoureve...

[martin_mueller]

By default, an automatic lookup will produce up to 1000 matches.

Are you trying to tag eventtypes? If so, have you looked at assigning actual tags for those eventtypes?

[snehalk]

Hello Martin,

When i done the automatic lookup, am not able to see Status field in indexed data.

[snehalk]

Hello Martin,

Thanks for reply
For doing automatic lookup we need to have unique field values from both the set (index data and lookup data) but in my case each event is tag to multiple eventtype. so how to do this ? in automatic lookup?