Getting Data In

Source from inputlookup to negative match against index

coryjett
New Member

Hello all!

I am trying to source from a CSV, do a negative lookup against an index, and then output anything from the CSV that did not return results in the index.

Our CSV contains a list of web applications. I want to take this list and run it against an index that contains web logs and output applications haven't produced logs in the past 30 days.

The CSV contains the following columns with app being the application name:
guid,app,version,epoch_time

The index has a field called url_host that exists on web log events and is the application name.

Here is what I have so far that is sort of working:

| inputlookup application_names.csv | dedup app | eval url_host=app | fields url_host | search NOT [search index=dev_applications | dedup url_host | fields url_host ] | sort url_host

In my output, I am still getting application names that have events in the dev_applications index so it appears not everything is getting filtered out. Not sure if I am doing something wrong or possibly hitting a subsearch limit of some kind.

I've been banging my head against this for a few hours...any help is appreciated!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=dev_applications 
| stats count by url_host 
| table url_host | rename url_host as app | eval hasEvent=1
| append [| | inputlookup application_names.csv | table app| dedup app | eval hasEvent=0]
| stats max(hasEvent) as hasEvent by app
| where hasEvent=0
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...