Loops on csv file

[kacel]

hi,
i comeback to ask u again about my problem ;
so :
| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*"
| foreach Hostname [eval temp = if(match(Parent,Hostname), "hello", "Noooooo") ]
| table temp

when i execut this the result is :
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo
Noooooo

the problem i me sur ther is a value from Parent that match Hostname
i want to that retun hello .
not only comparing in same raw that is the problem
thank you

[renjith_nair · Accepted solution]

@kacel,

Try this

| inputlookup Obso_Inventory.csv
| eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", 
                  Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", 
                  Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", 
                  Composant="TAP", "Anti-Intrusion")
|rename Compo as Composant
| search Composant="Firewall" Editeur="" Metier="" Platform="*" 
| eventstats values(Parent) as _tmp
| eval found=if(isnull(mvfind(_tmp,Hostname)),0,1)

[kacel]

Thank you very much the result shows 1 when it is a match and 0 else .

its the best way to find same value of coulumn without using loops between two culumn
thank u.

[kacel]

could you give us an explication please ?

[renjith_nair]

sure. Last two lines can be rewritten as below to give a better idea

| eventstats values(Parent) as tmp
 | eval found=if(isnull(mvfind(tmp,Hostname)),0,1)

By using eventstats we create a list of "Parents" for each row. Host name is then matched against this list which returns null for non-matching and an index for matching records . The result is then evaluated using if and assigns to "found" . 1 and 0 can be replaced with any values for e.g. "Yes","No" etc

Hope this helps!

[richgalloway]

Parent and Hostname must match exactly.
Please edit your query to show how the Parent and Hostname fields are obtained.