How to exclude Host using Inputlookup?

[karthi2809]

index=bp_prod NOT ([|inputlookup serverBP.csv|fields Servers Status |where Status=="N"] ) |eventstats count as "totalCount" | eventstats count as "choiceCount" by host| eval percent=(choiceCount/totalCount)*100 | stats values(choiceCount) as Count , values(percent) as Percentage by host

In my serverBP.csv i have following coloumn:

Servers Status

server1 Y
server2 Y
server3 N

I have to exclude server 3 in my query

[DalJeanis]

Change the subsearch to output only the server name for the servers with status N, and rename the field name to whatever the field will be called on the other index...

[|inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host]

You can see what the output of the implicit format command will be -- that is, what will be returned by the square brackets -- by running the search independently, and piping it to the explicit format command....

 |inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host | format

...which in this case will probably look like...

(host="server3")