Splunk Search

inputlookup and search results from data

Splunk_rocks
Path Finder

Hello Splunkers,

I have inputlooku test.csv and containing fields host region

I have indexed data under test index containing fields host location status area DC

So what i need take input from look up table field host and search with in indexed data for status .

I was trying below one but not sure this is correct .

index=test  status="Down"  [| inputlookup test.csv | fields host] | dedup host | table host status DC

any thing is fine either before filter or after filter goal is to just show the results for host which are in my list.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Your query looks correct, just one thing for you to keep in mind if you have very enormous amount of hosts in lookup your query may brake.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Splunk_rocks,

try this:

index=test  status="Down"  [| inputlookup test.csv | fields host | format ] | dedup host | table host status DC

By using format the sub search will return a string like this (( host=x ) OR (host=y) OR (host=z)) which then in turn will be used in the search.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...