Splunk Search

Issue in csv lookup while summarization

keerthana_k
Communicator

Hi,

We have scheduled saved search running every 5 minutes to create summary index.

In our test setup we get 200 log events every 5 minutes. The log events contain ServerIP field. We do a CSV lookup to get meaningful name for the server IP.

Our summarization query looks like this:

First part of the query | stats …… by _time, ServerIP, ….| lookup for ServerName | other fields.

When we verified the data in summarized index, there are some null values for the ServerName field. For the same ServerIP the lookup is successful at times and failing at other times.

Additional Information:

The CSV file has 50 entries
The IP addresses for which we do lookup are in positions 24 and 30.

Tags (2)
0 Karma
1 Solution

keerthana_k
Communicator

The problem was that the CSV file was up to date in one indexer and not updated in the other one. Hence the lookup was failing half the time.

View solution in original post

0 Karma

keerthana_k
Communicator

The problem was that the CSV file was up to date in one indexer and not updated in the other one. Hence the lookup was failing half the time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...