Splunk Search

How to compare a lookup field value with my current search?

AdixitSplunk
Path Finder

HI All,
I have a lookup table with host names value around 10 field name host.
I have this search index=Application sourcetype=Servers |stats count by host

I have to compare host in Lookup table with the one in above search and result should give only those host names which are not present in Lookup file.

Suppose my lookup file has below host names:

host
1
2
3
4 
5

My search gives:

host
1 
4
5

So the final result should be :

host
2
3

Thanks in advance.

Tags (2)
0 Karma
1 Solution

AdixitSplunk
Path Finder

Thanks for your reply but its not giving the right answer . The below did 🙂

index="Application" sourcetype=Servers|eval host=lower(host)|eval started_host="T"|append [inputlookup Mylookup|eval started_host="F"]|stats count(eval(started_host=="T")) as started by host|where started == 0

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=Application sourcetype=Servers | stats count by host | appendpipe [|inputlookup hostLookup | table host | eval sourcetype="LOOKUP"] | stats values(*) AS * dc(sourcetype) AS numDatasets BY host | search numDatasets=1 AND sourcetype="LOOKUP" | table host
0 Karma

AdixitSplunk
Path Finder

Thanks for your reply but its not giving the right answer . The below did 🙂

index="Application" sourcetype=Servers|eval host=lower(host)|eval started_host="T"|append [inputlookup Mylookup|eval started_host="F"]|stats count(eval(started_host=="T")) as started by host|where started == 0
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@AdixitSplunk - Did your above comment provide a working solution to your question? If yes and you would like to close out your post, please let me know so I can convert it to an Answer to be accepted. Thanks!

0 Karma

adayton20
Contributor

Try this:

index=Application sourcetype=Servers
| search [|inputlookup yourLookup | fields + host | table host] 
| stats count by host
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...