Can you help me with the following search using a lookup?

[a212830]

Hi,

We are frequently required to validate that data is being received by Splunk from multiple servers. The lists of IPs/hosts can be quite long. I am trying to come up with a search that will make this easier, like putting the entries into lookup files and then running a search against the entries in the lookups. So far, I have a lookup with a hostname, IP, and potentially, a wildcard for that host (sometimes the hosts are fully qualified and sometimes they are not). The IPs are reported as hosts, not as a separate "ip" field.

By using this search, I can retrieve data for hosts:

index=* [|inputlookup testSVB2.csv|table host ]

Is there anyway to expand this so it it will run a search against matching hosts OR IPs OR wildcards? When I table out host or IP, it seems to be running an "AND", rather than an "OR".

Finally, is there anyway to limit the number of events returned per host?

[sloshburch]

"We are frequently required to validate that data is being received by Splunk from multiple servers."
What about the Monitoring Console's page for Forwarders?

I use the alerts in MC as well to let me know of missing forwarders

[woodcock · Accepted solution]

You need the format command; here is a run-anywhere example:

|makeresults | eval raw="host1,ip1 host2,ip2 host3,ip3"
| makemv raw
| mvexpand raw
| rename raw AS _raw
| rex "^(?<host>\w+),(?<ip>\w+)$"
| table host ip
| format "(" "(" "OR" ")" "OR" ")"

In your case, like this:

 index=* [|inputlookup testSVB2.csv | table host ip | format "(" "(" "OR" ")" "OR" ")"]

To limit the number of events per host just do this (I have chosen to limit to 10):

 index=* [|inputlookup testSVB2.csv | table host ip | format "(" "(" "OR" ")" "OR" ")"]
| dedup 10 host

[a212830]

Thanks. These are both very good, it looks like woodcock's is more what I'm looking to implement. Is there anyway to limit the results per host? I tried "top limit=x", but that didn't work.

[a212830]

Figured it out. Add a "top limit=x host" to the end.

Also came up with a way to do the same thing via tstats, which is much faster.

Thanks!

[Vijeta]

You can achieve that using map command
|inputlookup estSVB2.csv|fields host ip| map search="index=* host=$host$ OR ip=$ip$| table host ip"