topic Re: Loops on csv file in Getting Data In

Loops on csv file

kacel — Wed, 03 Jul 2019 10:25:22 GMT

hi,
i comeback to ask u again about my problem ;
so :
| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*"
| foreach Hostname [eval temp = if(match(Parent,Hostname), "hello", "Noooooo") ]
| table temp

when i execut this the result is :
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo

the problem i me sur ther is a value from Parent that match Hostname
i want to that retun hello .
not only comparing in same raw that is the problem
thank you

Re: Loops on csv file

richgalloway — Wed, 03 Jul 2019 12:29:14 GMT

Parent and Hostname must match exactly.
Please edit your query to show how the Parent and Hostname fields are obtained.

Re: Loops on csv file

renjith_nair — Wed, 03 Jul 2019 12:51:05 GMT

@kacel,

Try this

| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", 
                  Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", 
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*" 
| eventstats values(Parent) as _tmp
| eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)

Re: Loops on csv file

kacel — Wed, 03 Jul 2019 13:33:01 GMT

Thank you very much the result shows 1 when it is a match and 0 else .

its the best way to find same value of coulumn without using loops between two culumn
thank u.

Re: Loops on csv file

kacel — Wed, 03 Jul 2019 13:37:04 GMT

could you give us an explication please ?

Re: Loops on csv file

renjith_nair — Wed, 03 Jul 2019 14:00:09 GMT

sure. Last two lines can be rewritten as below to give a better idea

| eventstats values(Parent) as tmp
 | eval found=if(isnull(mvfind(tmp,Hostname)),0,1)

By using eventstats we create a list of "Parents" for each row. Host name is then matched against this list which returns null for non-matching and an index for matching records . The result is then evaluated using if and assigns to "found" . 1 and 0 can be replaced with any values for e.g. "Yes","No" etc

Hope this helps!