Hi , i am facing some issue with query. My question is how to show only those filetype name which came in logs. Check in lookupfile, if any if filetype is missed then it must show in result.
index=sap_bam sourcetype=sap_d059 | lookup sap_filetype.csv filetype as filetype | dedup source | stats count by filetype | rename count as filecount | eval alertme=if((filecount=0) OR isnull(filecount),1,0) | fields sourcetype filetype filecount alertme | table filetype filecount alertme
It's difficult to make out exactly what the use case is, but we've clarified your question as much as possible.
I believe you are trying to receive an alert when any particular "filetype" has not been seen in a certain length of time.
Here are some answers that have searches you can model
using a lookup as a base list
using tstats to generate a base list