Splunk Search

How to map the lookup conditions and get the indexed data in splunk

snehalk
Communicator

Hello Everyone,

I have requirement where i need to search eventtype which are present in my lookup table, say in lookup i have one column name called "eventtype" and other column "Status" value as pass or Fail

eg:

 eventtype  Status 
    xyz         pass 
   abc          Fail

So in my final result i want the all indexed data with eventtype "xyz"

Below is what i tried but its not working

index=myindex sourcetype=aa  [ | inputlookup myfile.csv where Status ="pass"| table eventtype ] 

Can any one help me on this?

Thanks,
Snehal Kinekar

0 Karma

woodcock
Esteemed Legend

In Splunk, eventtypes are a search-time-only construct so what you are asking (something index-time based on eventtypes) is utterly impossible. Perhaps I am being "too literal" and I might have a better/different answer if you rephrased your question.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you define your lookup to be automatic (Settings -> Lookups -> Automatic Lookups) for that sourcetype inputting eventtype and outputting Status, you will be able to search like this:

index=myindex sourcetype=aa Status=pass

http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usefieldlookupstoaddinformationtoyoureve...

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

By default, an automatic lookup will produce up to 1000 matches.

Are you trying to tag eventtypes? If so, have you looked at assigning actual tags for those eventtypes?

0 Karma

snehalk
Communicator

Hello Martin,

When i done the automatic lookup, am not able to see Status field in indexed data.

0 Karma

snehalk
Communicator

Hello Martin,

Thanks for reply
For doing automatic lookup we need to have unique field values from both the set (index data and lookup data) but in my case each event is tag to multiple eventtype. so how to do this ? in automatic lookup?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...