Splunk Search

Extracting fields from look up file & calculating each field count

marellasunil
Communicator

Hi,
I am having a lookup csv file, I have uploaded it in Automatic lookup's with Application=Application_Name & Server_Name=host
Application_Name & host are listed in fields.
CSV file is as below

Application, Server_Name

App1, server1
App1, Server2
App1, Server3
App1, Server4
App2, Server2
App2, Server5
App2, Server6
App2, Server7

..| append [inputlookup servers_lookup] | search Application="App1" | chart count over Server_Name by Status
If I use the above command, I am getting the below output

Server count

server1 1
Server2 1
Server3 1
Server4 1

But If I run the query with host instead of Server_Name

Server count

server1 11
Server2 23
Server3 42
Server4 8
Which is actaul count.

Could you please help me to get the correct result by using lookfield

0 Karma
1 Solution

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

View solution in original post

0 Karma

marellasunil
Communicator

Ooo, Worked now, Problem with the case sensitive....

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...