compare field from search with field from csv file

[sarit_s]

Hello

I have csv file with host names

also, i have this query :

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset"

this search returns the host name.

how can i search within the hosts in the csv file so only the ones from the file will return in my global search ?

thanks 

[manjunathmeti · Accepted solution]

hi @sarit_s,

Assuming you field host in CSV file, you can filter in the main search only.

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" [| inputlookup filename.csv | field host | format]