- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to get the where condition from a lookup sourc...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I dont understand why my "where" condition doesnt work
could you help me please?
| inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 |where HealthState00 > 99 | stats count by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?
| inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?
| inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found!
I added brackets like this where HealthState00 > "90,00"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jip31 Just remove stats count by host and see if it gives you any results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when I m doing | inputlookup host.csv I have results
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your PanaBatteryStatus.csv lookup has field called Hostname00 and host.csv has a field host?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes for both
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok.. Does the field values match exactly (by default the lookup match is case sensitive) between two lookup table files (Hostname00 from PanaBatteryStatus.csv and host from host.csv)? Also, when you say the where condition doesn't work, does it not filter the data OR it's filtering all data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes they match exacly
when I add the where conditions I have any results
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
add 'host' after OUTPUT as you are using in stats
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when I m doing | inputlookup host.csv I have results
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
but if I add host after output, I have no results
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
