Search with lookup

[bosseres]

Hello

I have a lookup, which contains hostnames, how can I make search over indexes (for example index=*) only by hostnames which in lookup? thank you.

[scelikok · Accepted solution]

Hi @bosseres,

You can try below; I assume your lookup and indexed logs have "hostname" field. Otherwise you may need to rename fields.

index=* [|inputlookup hostname.csv | fields hostname]

[bosseres]

thank you!

[ITWhisperer]

index=* [| inputlookup hosts.csv | table host]