Hello all... I have to compare two lookup table files in splunk. One is a list of hosts that should Be logging, and the other is a list of what isnt logging. I tried a few different things, to no avail. My goal is to build a list of what isnt logging compared to the list of what is logging.
I mean this is splunk, it cant be that hard 🙂
| inputlookup lookupfile1 | lookup lookupfile2 host OUTPUTNEW host as isFound | where isnull(isFound)
Hope this helps, Thanks!