I can descrbie a stage w/ the identifier:
desc stage identifier('db.schema.stage_name');
But get an error when I try to use the stage with the at symbol syntax
Have tried these variations but no dice so far:
list #identifier('db.schema.stage_name');
list identifier('#db.schema.stage_name');
list identifier('db.schema.stage_name');
list identifier(#'db.schema.stage_name');
list identifier("#db.schema.stage_name");
The use of IDENTIFIER may indicate the need to query/list content of a stage with stage name provided as variable.
An alternative approach could be usage of directory tables:
Directory tables store a catalog of staged files in cloud storage. Roles with sufficient privileges can query a directory table to retrieve file URLs to access the staged files, as well as other metadata.
Enabling directory table on the stage:
CREATE OR REPLACE STAGE test DIRECTORY = (ENABLE = TRUE);
ALTER STAGE test REFRESH;
Listing content of the stage:
SET var = '#public.test';
SELECT * FROM DIRECTORY($var);
Output:
+---------------+------+---------------+-----+------+----------+
| RELATIVE_PATH | SIZE | LAST_MODIFIED | MD5 | ETAG | FILE_URL |
+---------------+------+---------------+-----+------+----------+
As I am working on network security project. I need to create private lookup table for individual users, such that any other user shouldn't see the content of other users Lookup table.
I have created Lookup table by:
curl -k -u username:pwd https://localhost:8089/servicesNS/nobody/*appname*/data/lookup-table-files -d 'eai:data=/opt/splunk/var/run/splunk/lookup_tmp/april.csv' -d 'name=12_april_lookup.csv'
This created 12_april_lookup.csv file inside .../my_app/lookup/ folder. This Lookup table permission is private at this point.
But,
When I add some data to Lookup table by below search command:
| makeresults | eval name="xyz" | eval token="12345"| outputlookup 12_april_lookup.csv append=True createinapp=True
then file will get created in other app folder with become global permission. Now all user can view file content by
|inputlookup 12_april_lookup.csv
Need to run below command with same app search section:
As this command was running on global app level, so file was created at global level with global permission.
In splunk every app has search section. Based on which app search section file will be created in that app lookup folder.
Make sure every search we do in splunk, You are in correct app section.
| makeresults | eval name="xyz" | eval token="12345"| outputlookup 12_april_lookup.csv append=True createinapp=True
I have a PowerShell command like this:
Search-ADAccount -AccountDisabled -UsersOnly | FT Name
> C:\Users\hou\Downloads\DisabledAccount.csv
This command can grab all disabled account names from AD and put it into a .CSV file.
I want to set up a job in SQL Server agent so it will run the command whenever I need it.
But the Agent keep gives me error when I was trying to run the job.
Can anyone let me know the right command for this while running in SQL Server agent?
You might have other issues but the glaring first one you have is you do not have a CSV file. If you opened the file you would see that it is not following any CSV standard but that of a formatted table.
Search-ADAccount -AccountDisabled -UsersOnly |
Export-CSV -notypeinformation C:\Users\hou\Downloads\DisabledAccount.csv
Format-Table is just for showing information on the screen. Not for use of generating output. If you want to make a CSV then that is what Export-CSV is there to do. If you only wanted the name column then you could add a Select-Object in the pipe.
Search-ADAccount -AccountDisabled -UsersOnly |
Select-Object Name |
Export-CSV -notypeinformation C:\Users\hou\Downloads\DisabledAccount.csv
In Splunk I need to match search results client IP list with an input lookup CSV file knownip.csv. I want the results, which didn't match with CSV file.
Step 1. Created list of verified known IP as a CSV file saved in my local system
Step 2. Navigated Manager > Lookups > Add New > Lookup Table File
Step 3. Uploaded my file and named it KnownIP.csv. Now under Manager > Lookups > Add New > Lookup Definition I have name=clientIP, lookup-file=KnownIP.csv.
Step 4. Now I defined my search query like this:
search NOT[|inputlookup Lookupfile | fields Name ] index=* serverName>servername113
| rex field=clientIP "(?<clientIP>\d+.\d+.\d+)"
| stats count by clientIP
| search NOT [|inputlookup append=t KnownIP.csv|fields clientIP]
As I noted, I need help getting this search to match the CSV file.
There are a couple ways to do what you're asking for
The first is to use the lookup table as a filter in your initial search, like this:
index=ndx sourcetype=srctp NOT [|inputlookup mylookup | fields ip]
Or, do a lookup, and keep all the entries that have a null value in the lookup's other field ... like this:
index=ndx sourcetype=srctp
| lookup mylookup ip OUTPUT otherfield AS filterfield
| where isnull(filterfield)
I'm fairly new to PowerShell, and am wondering if someone knows of any better way to accomplish the following example problem.
I have an array of mappings from IP address to host-name. This represents a list of active DHCP leases:
PS H:\> $leases
IP Name
-- ----
192.168.1.1 Apple
192.168.1.2 Pear
192.168.1.3 Banana
192.168.1.99 FishyPC
I have another array of mappings from MAC address to IP address. This represents a list of IP reservations:
PS H:\> $reservations
IP MAC
-- ---
192.168.1.1 001D606839C2
192.168.1.2 00E018782BE1
192.168.1.3 0022192AF09C
192.168.1.4 0013D4352A0D
For convenience, I was able to produce a third array of mappings from MAC address to IP address and host name using the following code. The idea is that $reservations should get a third field, "Name", which is populated whenever there's a matching "IP" field:
$reservations = $reservations | foreach {
$res = $_
$match = $leases | where {$_.IP -eq $res.IP} | select -unique
if ($match -ne $NULL) {
"" | select #{n="IP";e={$res.IP}}, #{n="MAC";e={$res.MAC}}, #{n="Name";e={$match.Name}}
}
}
The desired output is something like this:
PS H:\> $ideal
IP MAC Name
-- --- ----
192.168.1.1 001D606839C2 Apple
192.168.1.2 00E018782BE1 Pear
192.168.1.3 0022192AF09C Banana
192.168.1.4 0013D4352A0D
Is there any better way of doing this?
After 1.5 years, the cmdlet I had pasted in the original answer has undergone so many updates that it has become completely outdated. Therefore I have replaced the code and the ReadMe with a link to the latest version.
Join-Object
Combines two object lists based on a related property between them.
Description
Combines properties from one or more objects. It creates a set that can be saved as a new object or used as it is. An object join is a means for combining properties from one (self-join) or more object lists by using values common to each.
Main features
Intuitive (SQL like) syntax
Smart property merging
Predefined join commands for updating, merging and specific join types
Well defined pipeline for the (left) input objects and output objects (preserves memory when correctly used)
Performs about 40% faster than Compare-Object on large object lists
Supports (custom) objects, data tables and dictionaries (e.g. hash tables) for input
Smart properties and calculated property expressions
Custom relation expressions
Easy installation (dot-sourcing)
Supports PowerShell for Windows (5.1) and PowerShell Core
The Join-Object cmdlet reveals the following proxy commands with their own (-JoinType and -Property) defaults:
InnerJoin-Object (Alias InnerJoin or Join), combines the related objects
LeftJoin-Object (Alias LeftJoin), combines the related objects and adds the rest of the left objects
RightJoin-Object (Alias RightJoin), combines the related objects and adds the rest of the right objects
FullJoin-Object (Alias FullJoin), combines the related objects and adds the rest of the left and right objects
CrossJoin-Object (Alias CrossJoin), combines each left object with each right object
Update-Object (Alias Update), updates the left object with the related right object
Merge-Object (Alias Merge), updates the left object with the related right object and adds the rest of the new (unrelated) right objects
ReadMe
The full ReadMe (and source code) is available from GitHub: https://github.com/iRon7/Join-Object
Installation
There are two versions of this Join-Object cmdlet (both versions supply the same functionality):
Join Module
Install-Module -Name JoinModule
Join Script
Install-Script -Name Join
(or rename the Join.psm1 module to a Join.ps1 script file)
and invoked the script by dot sourcing:
. .\Join.ps1
Answer
To answer the actual example in the question:
$reservations |LeftJoin $leases -On IP
IP MAC Name
-- --- ----
192.168.1.1 001D606839C2 Apple
192.168.1.2 00E018782BE1 Pear
192.168.1.3 0022192AF09C Banana
192.168.1.4 0013D4352A0D
Performance
A little word on performance measuring:
The PowerShell pipeline is designed to stream objects (which safes memory), meaning that both¹ lists of input objects usually aren't (shouldn't be) resident in memory. Normally they are retrieved from somewhere else (i.e. a remote server or a disk). Also, the output usually matters where linq solutions are fast but might easily put you on the wrong foot in drawing conclusions because linq literally defers the execution (lazy evaluation), see also: fastest way to get a uniquely index item from the property of an array.
In other words, if it comes to (measuring) performance in PowerShell, it is important to look to the complete end-to-end solution, which is more likely to look something like:
import-csv .\reservations.csv |LeftJoin (import-csv .\leases.csv) -On IP |Export-Csv .\results.csv
(1) Note: unfortunately, there is no easy way to build two parallel input streams (see: #15206 Deferred input pipelines)
(more) Examples
More examples can be found in the related Stack Overflow questions at:
Combining Multiple CSV Files
Combine two CSVs - Add CSV as another Column
CMD or Powershell command to combine (merge) corresponding lines from two files
Can I use SQL commands (such as join) on objects in powershell, without any SQL server/database involved?
Powershell match properties and then selectively combine objects to create a third
Compare Two CSVs, match the columns on 2 or more Columns, export specific columns from both csvs with powershell
Merge two CSV files while adding new and overwriting existing entries
Merging two CSVs and then re-ordering columns on output
Efficiently merge large object datasets having multiple matching keys
Is there a PowerShell equivalent of paste (i.e., horizontal file concatenation)?
How to compare two CSV files and output the rows that are in either of the file but not in both
How to join two CSV files in Powershell with SQL LIKE syntax
How can merge 3 cycle and export in one table
Merging two arrays object into one array object in powershell
And in the Join-Object test script.
Please give a 👍 if you support the proposal to Add a Join-Object cmdlet to the standard PowerShell equipment (#14994)
This can also be done using my module Join-Object
Install-Module 'Join-Object'
Join-Object -Left $leases -Right $reservations -LeftJoinProperty 'IP' -RightJoinProperty 'IP'
Regarding performance, I tested against a sample data of 100k lines:
Hashtable example posted by #js2010 run in 8 seconds.
Join-Object by me run in 14 seconds.
LeftJoin by #iRon run in 1 minute and 50 seconds
Here's a simple example using a hashtable. With big arrays, this turns out to be faster.
$leases =
'IP,Name
192.168.1.1,Apple
192.168.1.2,Pear
192.168.1.3,Banana
192.168.1.99,FishyPC' | convertfrom-csv
$reservations =
'IP,MAC
192.168.1.1,001D606839C2
192.168.1.2,00E018782BE1
192.168.1.3,0022192AF09C
192.168.1.4,0013D4352A0D' | convertfrom-csv
$hashRes=#{}
foreach ($resRecord in $reservations) {
$hashRes[$resRecord.IP] = $resRecord
}
$leases | foreach {
$other = $hashRes[$_.IP]
[pscustomobject]#{IP=$_.IP
MAC=$other.MAC
Name=$_.name}
}
IP MAC Name
-- --- ----
192.168.1.1 001D606839C2 Apple
192.168.1.2 00E018782BE1 Pear
192.168.1.3 0022192AF09C Banana
192.168.1.99 FishyPC
Easiest way I've found to Merge two Powershell Objects is using ConvertTo-Json and ConvertFrom-Json
One liner based on the OPs Senario:
$leases | foreach {(ConvertTo-Json $_) -replace ("}$", (ConvertTo-Json ($reservations | where IP -eq $_.IP | select * -ExcludeProperty IP)) -Replace "^{", ",")}
| ConvertFrom-Json
Results in:
IP Name Mac
-- ---- ---
192.168.1.1 Apple 001D606839C2
192.168.1.2 Pear 00E018782BE1
For another example lets make a couple objects:
$object1 = [PSCustomObject]#{"A" = "1"; "B" = "2"}
$object2 = [PSCustomObject]#{"C" = "3"; "D" = "4"}
Merge them together using Json by replacing the opening and closing brackets:
(ConvertTo-Json $object1) -replace ("}$", $((ConvertTo-Json $object2) -Replace "^{", ",")) | ConvertFrom-Json
Output:
A B C D
- - - -
1 2 3 4
Another example using a group of objects:
$mergedObjects = [PSCustomObject]#{"Object1" = $Object1; "Object2" = $Object2}
Object1 Object2
------- -------
#{A=1; B=2} #{C=3; D=4}
Can just do the same again within a foreach:
$mergedObjects | foreach {(ConvertTo-Json $_.Object1) -replace ("}$", $((ConvertTo-Json $_.Object2) -Replace "^{", ",")) | ConvertFrom-Json}
Output:
A B C D
- - - -
1 2 3 4
You can use script block like this
$leases | select IP, NAME, #{N='MAC';E={$tmp=$_.IP;($reservations| ? IP -eq $tmp).MAC}}