Splunk Search

How to inputlookup a csv file which contains only the hostnames and get the field values of A,b and C?

pavanae
Builder

I have a lookup file which contains a list of hostnames under the field Host like below

Host
abd
addf
fdfs

Now how can I get the field values for those hosts in lookup from splunk for A,B and C like below

Host A B C

I am trying to find a simplified way if there is any in splunk instead of searching manually in splunk like below for each host

Host="chdg" OR Host="jkhgsdjh"........ | stats values (A), values(B), values(C) by Host

1 Solution

jkat54
SplunkTrust
SplunkTrust

Is this what you’re looking for?

[| inputlookup hosts.csv host as Host | fields host | format ] | stats values(a) by host

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is this what you’re looking for?

[| inputlookup hosts.csv host as Host | fields host | format ] | stats values(a) by host
0 Karma

pavanae
Builder

Yes. Thank you. Although there is a small type on the query and corrected below :-

[| inputlookup hosts.csv | rename Host as host | fields host | format ] | stats values(a) by host

0 Karma

niketn
Legend

@pavanae, you might have to add more details on what you need. Whether you do not want to write the Host names in base search or fields names in stats functions? Try the following and confirm:

<your_base_search_with_index_and_sourcetype> [| inputlookup <yourCSVFile>.csv | table Host]
| stats values(*) as * by Host

Please add more details also the context of what field names are and their corresponding value.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...