Filtered list

[Bracha]

Hi
I have a dashboard that displays CSV
I want to add lists for him to display that are not in the CSV
But the list I'm adding includes the records that are in the CSV
I want to create a list that will not include the records in the CSV

This code gets me the whole list

| index="------" interface="--"
|stats values(interface) as importers

This code brings me the list from the CSV

index="------------" code=*
| search
         [|inputlookup importers.csv
          |lookup importers.csv interfaceName OUTPUTNEW system environment timerange
          |stats
                 values(interfaceName) as importers_csv

I want a code that brings me the list without the records in the CSV
Thanks

[gcusello]

Hi @Bracha ,

let me understand: in the importers.csv file you have a list of interfaces and you want to filter your results using the above lookup or you want to check if they are present in the index?

if you want to filter your results using the lookup, you can use a subsearch, putting attention that the field names in main and sub search are the same (in your case interfaceName):

index="------------" code=* [|inputlookup importers.csv | fields interfaceName ]
|stats values(interfaceName) as importers_csv

 If instead you want to know if there are interfaceNames in the lookup not present in the results of the main search, you have to run something like this:

index="------------" code=* 
| stats count BY interfaceName 
| append [ | inputlookup importers.csv | eval count=0 |fields interfaceName count ]
| stats sum(count) AS total BY interfaceName
| eval status=if(total=0,"Not present","present")
| table interfaceName status

Ciao.

Giuseppe

[Bracha]

Hi @gcusello 

thank you for your quick response

I have two lists

1. importers - includes many importers 

2. importers_csv - contains some of the importers from the first list

I want a list which will contain the importers that are not in the CSV file

How to do it?

[gcusello]

Hi @Bracha ,

you have to use the first solution:

| inputlookup importers WHERE NOT [ | inputlookup importers_csv | fields interfaceName ] 

put attention that the field names are the same (interfaceName).

Ciao.

Giuseppe

[Bracha]

@gcusello 

I want all records that not in csv

[gcusello]

Hi @Bracha ,

with the above search you have all the records not in csv.

Ciao.

Giuseppe