I have a lookup file called
us_customers.csv that contains a single field:
I would like to filter the results of my query to the customers in the lookup CSV file.
This query works for me, I see exactly the hosts that belong to the customers:
[ | inputlookup us_customers.csv ] | stats count by host
So I made a macro:
[us_customers] definition = search [ | inputlookup us_customers.csv ]
And now querying using it:
`us_customers` | stats count by host
I see only a partial result set.
Can anyone explain why this doesn't work?
The man who wrote macros is @sideview and he recently commented in slack more fully than he did in this answer:
Perhaps he will share some of that additional commentary here now.