SPLUNK 簡單查詢語句| lookup使用
Here is offical document: http://docs.splunk.com/Documentation/SplunkCloud/7.0.2/Search/GetstartedwithSearch
| inputlookup all_w
| search slavename="MAC-BUILD-GIT*"
| join type=outer slavename
[ search index="acadci_mp_prod" category=taskEnded slavename=*
| stats count by slavename
]
| eval count=if(isnull(count), "0", count)
| sort -count
上面這個SPL類似於SQL的全連線, type=outer
inputlookup lookup_table_name: 相當於 select * from lookup_table_name
| search slavename="MAC-BUILD-GIT*" 相當於 where slavename = "MAC-BUILD-GIT*"
[ search index="acadci_mp_prod" category=taskEnded slavename=*
| stats count by slavename
]
是個子查詢
eval可以對現有的field計算 變形等 生成新的filed
sort 用來排序
Note: type= inner left outer 官方說left 與outer是一樣的 , 但實際並不一樣. default是left.
LOOKUP使用的時候需要某個field名與要查詢的表相同.