topic Re: CSV lookup and count the value in Getting Data In

CSV lookup and count the value

Stephan — Mon, 05 Oct 2020 11:21:22 GMT

Hello,
I have a CSV file with two fields (ID and description) and I want to know if any of the IDs are found in a search. It would be great if the output comes in a table with count and the description.

CSV is like:
ID, description
1, abc
2, lmn
3, yxz

output:

ID	description	count
2	lmn	6
1	abc	3

is that possible?

regards
Stephan

Re: CSV lookup and count the value

ITWhisperer — Mon, 05 Oct 2020 11:29:08 GMT

First you could count by id, then lookup the description from the csv file.

| stats count by id | lookup file.csv

Depending on your actual search, you may need to adjust the field names to match

Re: CSV lookup and count the value

Stephan — Mon, 05 Oct 2020 11:51:42 GMT

Thanks a lot. That works. I have to add a "where isnotnull(description" to the command to filter the Events that are not in the CSV.