I have a lookup file called
us_customers.csv that contains a single field:
I would like to filter the results of my query to the customers in the lookup CSV file.
This query works for me, I see exactly the hosts that belong to the customers:
[ | inputlookup us_customers.csv ] | stats count by host
So I made a macro:
[us_customers] definition = search [ | inputlookup us_customers.csv ]
And now querying using it:
`us_customers` | stats count by host
I see only a partial result set.
Can anyone explain why this doesn't work?
It will work if you do this:
| `us_customers` | stats count by host
And define it like this:
definition = inputlookup us_customers.csv
Thanks. I understand why it works using a pipe, but I'm wondering why it's no good as a base search.
The word "search" is not needed / not valid in a base search. Try
index=* where you have
The man who wrote macros is @sideview and he recently commented in slack more fully than he did in this answer:
Perhaps he will share some of that additional commentary here now.