Hello
I have a lookup, which contains hostnames, how can I make search over indexes (for example index=*) only by hostnames which in lookup? thank you.
Hi @bosseres,
You can try below; I assume your lookup and indexed logs have "hostname" field. Otherwise you may need to rename fields.
index=* [|inputlookup hostname.csv | fields hostname]
Hi @bosseres,
You can try below; I assume your lookup and indexed logs have "hostname" field. Otherwise you may need to rename fields.
index=* [|inputlookup hostname.csv | fields hostname]
thank you!
index=* [| inputlookup hosts.csv | table host]