index=myindex| stats count by host | rename host as DNS |eval result="index"|append [| inputlookup test.csv |eval result="csv" ]|stats count(DNS) as tmp dc(DNS) as unique|eval duplicated = tmp - unique | eval diff = unique - duplicated | table duplicated diff |transpose column_name=result| rename "row 1" as count
index=myindex | append [ |inpulookup test.csv | rename DNS as host] | stats count by host | stats count(eval(if(count=1, 1, null))) as no_event_hosts, count(eval(if(count>1, 1, null))) as hosts_with_events
Thanks for helping out, but this didnt produce the outcome I'm looking for.
Is it possible to output the test.csv DNS column and host column from the indexed data and then do a dif?
Thanks that was helpful, but I still don't know how to get the dif displayed. Meaning, I want items in my test.csv displayed that no events are matching.
Step 2 would be to compare the amount of hosts in test.csv that are not matched with events, to the total number of host names reporting for a certain index and sourcetype.