Splunk Search

Search help ?

splunker969
Communicator

When Iam trying to run this search its giving me wrong results .Please correct my search. In my csv is having to coumlmns one is host and other H=YES . Thanks

| metadata type=hosts index=*
| join [| inputlookup watchlist1.csv |search H=YES| rename Host as host]
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host
| sort lastTime
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount

Tags (2)
0 Karma

elliotproebstel
Champion

Are you trying to filter the results of the metadata query to only show hosts from your lookup file that contain YES in the H field? If so, give this a shot:

| metadata type=hosts index=* 
| search 
 [| inputlookup watchlist1.csv 
 |search H="YES"
 | rename Host as host
 | fields host ] 
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host 
| sort lastTime 
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount 

splunker969
Communicator

Hi ellitproebstel ,

Thanks :)Search is working can you help me to find the fully qualified name for host when i search its giving me host name in short cut .

0 Karma

elliotproebstel
Champion

Do you have the fully qualified name somewhere in your logs or in a lookup?

0 Karma

splunker969
Communicator

logs are having names

0 Karma

splunker969
Communicator

In csv better we need to keep host names as below i got results but in more hosts than csv file .

    host     H
     YY*      YES
      XX*      YES
0 Karma

splunker969
Communicator

Hi Mate,

As we are getting the duplicate results from the csv table and the results are coming with both normal host name and hostname with FQDNS. How do we resolve this and please suggest.

Example:
host
host.com

Thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...