Hello Everyone,
I have requirement where i need to search eventtype which are present in my lookup table, say in lookup i have one column name called "eventtype" and other column "Status" value as pass or Fail
eg:
eventtype Status
xyz pass
abc Fail
So in my final result i want the all indexed data with eventtype "xyz"
Below is what i tried but its not working
index=myindex sourcetype=aa [ | inputlookup myfile.csv where Status ="pass"| table eventtype ]
Can any one help me on this?
Thanks,
Snehal Kinekar
In Splunk, eventtypes
are a search-time-only construct so what you are asking (something index-time based on eventtypes
) is utterly impossible. Perhaps I am being "too literal" and I might have a better/different answer if you rephrased your question.
If you define your lookup to be automatic (Settings -> Lookups -> Automatic Lookups) for that sourcetype inputting eventtype
and outputting Status
, you will be able to search like this:
index=myindex sourcetype=aa Status=pass
By default, an automatic lookup will produce up to 1000 matches.
Are you trying to tag eventtypes? If so, have you looked at assigning actual tags for those eventtypes?
Hello Martin,
When i done the automatic lookup, am not able to see Status field in indexed data.
Hello Martin,
Thanks for reply
For doing automatic lookup we need to have unique field values from both the set (index data and lookup data) but in my case each event is tag to multiple eventtype. so how to do this ? in automatic lookup?