Splunk Search

How to get the where condition from a lookup source, work?

jip31
Motivator

Hello

I dont understand why my "where" condition doesnt work
could you help me please?

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 |where HealthState00 > 99 | stats count by host
0 Karma
1 Solution

jip31
Motivator

But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population

View solution in original post

0 Karma

jip31
Motivator

But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population
0 Karma

jip31
Motivator

I found!
I added brackets like this where HealthState00 > "90,00"

0 Karma

Vijeta
Influencer

@jip31 Just remove stats count by host and see if it gives you any results.

0 Karma

jip31
Motivator

when I m doing | inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
I have results

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does your PanaBatteryStatus.csv lookup has field called Hostname00 and host.csv has a field host?

0 Karma

jip31
Motivator

Yes for both

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Ok.. Does the field values match exactly (by default the lookup match is case sensitive) between two lookup table files (Hostname00 from PanaBatteryStatus.csv and host from host.csv)? Also, when you say the where condition doesn't work, does it not filter the data OR it's filtering all data?

0 Karma

jip31
Motivator

yes they match exacly
when I add the where conditions I have any results

0 Karma

lakshman239
SplunkTrust
SplunkTrust

add 'host' after OUTPUT as you are using in stats

0 Karma

jip31
Motivator

when I m doing | inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
I have results
but if I add host after output, I have no results

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...