Getting Data In
Highlighted

How to find matching and un-matching field values between an index and lookup file?

Communicator

Hi,

I have a CSV ( current_assets.csv) with fields device_name and ip (and tons of values for them). Here is an example:

device_name        ip
  router1     122.145.11.2
  laptop2     11.121.44.55

How do I search my index ( sourcetype="device_assets") for the CSV IPs and return whether or not each IP is found within the index?

An example result would be:

device_name        ip        found
  router1     122.145.11.2    Yes
  laptop2     11.121.44.55    No

Important note: The solution CANNOT use |join command because this is very intensive/slow for my current deployment.

Thanks

0 Karma