Splunk Search

inputlookup(csv) with Distinct_count

priya777
New Member

Hi There!
I have created a list of 2000 names in a CSV file. I am trying to get the phone numbers of these 2000 people using the below query,

index=*** event=contact [ | inputlookup names.csv | fields names ] | stats dc(phoneNumber) by names | fillnull value=0 names

When I do the distinct count I only get the names who are registered, but I need the remaining names - dc(phone_numbers) as 0, when I run the query.

0 Karma

to4kawa
Ultra Champion
 index=yours event=contact 
| inputlookup append=t names.csv 
| stats dc(phoneNumber) by names 

names.csv:

names
johndoo
hoobar

How about this. If your csv is not this format, fix it.

0 Karma

priya777
New Member

Thanks for your reply, but the above query is not taking the inputs from the file

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Your query filters index=*** event=contact with names exist in lookup file. Use OR in the search like below.

index=*** event=contact OR [ | inputlookup names.csv | fields names ] | stats dc(phoneNumber) by names | fillnull value=0 names
0 Karma

priya777
New Member

@DalJeanis Please suggest

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...