Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to find diff between a inputlookup and search result?

$
0
0
I've a lookup file which have a mount list with respective servers. Now I have a script which logs the mount available in every 15 min. I want to create an alert if there is any mount missing from what is mentioned in lookup file. Example - lookup file (host_mount.csv)- Host,Mount_to_monitor host1,/opt host1,/var host1,/usr host2,/var host2,/foo host3,/bar host3,/usr Say my search result table from log of script like - HostName,Mount host1,/opt host1,/usr host2,/var host2,/foo host3,/bar which means the diff which is missing would be - Host,Missing_mount host1,/var host3,/usr How should i do this?

Viewing all articles
Browse latest Browse all 47296

Trending Articles