About DanWilkinson

DanWilkinson · ‎11-06-2023

Thank you for the response. I did manage to figure out my issue. First was the use of the multiple lookups, when I created the first lookup, I used sort, that limited my results to > 5000, and I needed < 30k. I fixed that, creating the Inputlookup ACResults.csv without the sort value that was limiting my results. (inputlookup was from Active Directory). Then used the following search: index=Myindex host=xx.xx.xx.xx "AAA user accounting Successful" | dedup user Then used lookup for where the user field values matched the field cn from my lookup: | lookup ACResults.csv cn as user Final result of my new search: index=Myindex host=xx.xx.xx.xx "AAA user accounting Successful" | dedup user | lookup ACResults.csv cn as user | eval Sector=extensionAttribute14 | stats count by Sector | sort -count Answering your questions: -What is the relationship between the field you tabled ("user") and all the lookup tables? -user = cn from active directory -And the relationship with "field_stats_wanted"? -extensionAttribute14 for that user (cn) from Active Directory - Most importantly, why is inputlookup even considered? -all my inputlookups had the same fields, so appending would make it easier to search, (I thought), I was wrong. -It usually means that the problem is not clearly understood. - that was true, but I learned. I hope this helps for future users. Thank you all the same.

DanWilkinson · ‎11-02-2023

Hello and thank you for your time. I would like to run a search in splunk, using the results against inputlookup lists to return the stats or multiple stats. Example: My search is: index="MyIndex" AND host="MyHost" AND (*string1* OR "*string2*" OR "*string3*") | dedup user | table user user_results user.name1 user.name2 user.name3 using those results: | inputlookup ACBounceList_a-c.csv | inputlookup append=t ACBounceList_d-g.csv | inputlookup append=t ACBounceList_h-l.csv | inputlookup append=t ACBounceList_m-q.csv | inputlookup append=t ACBounceList_r-s.csv | inputlookup append=t ACBounceList_t-v.csv | inputlookup append=t ACBounceList_w-z.csv | stats count by field_stats_wanted | where inputlookup_user = user_results resulting in: field_stats_wanted count value1 30 value2 35 etc etc Any assistance with this would be greatly appreciated.

DanWilkinson · ‎11-08-2021

Good Morning, I am trying to create an alert to indicate that data has stopped flowing to a specific index and host after 24 hours, once created, the alert would continuously trigger. but only alerted after a new occurrence of data was received. My current settings for my alert are as follows: ------------------------------- Settings Alert Safelnk DOM East - No Data > 24 hours Description Search | metadata type=hosts index="index Hidden" | where host="Hostname_Hidden" | eval age=abs((recentTime-now())) | where age >86400| table host recentTime age | convert ctime(recentTime) Scheduled: run everyday At: 10:00 Expires: 999 hour(s) Trigger Conditions Trigger alert when Number of Results is Greater than: 0 Trigger: Once For each result Throttle: Suppress results containing field value: Suppress triggering for: 12 hour(s) Trigger Actions: When triggered: Email is sent ------------------------------- data that is sent when triggered: host recentTime age "Hostname_Hidden" 11/08/2021 386

Posts	3
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎11-08-2021

Online Status	Offline
Date Last Visited	‎11-06-2023 06:51 PM

index query results against inputlookup return sta...

Alert when No data received on index more than 24 ...

Re: index query results against inputlookup return...

index query results against inputlookup return sta...

Alert when No data received on index more than 24 ...