Hi folks,
I'm trying to append multiple field values to a csv as a result of a search. The csv file contains a list of seen hashes.
I have the following query:
index=AV NOT([ | inputlookup Hashes.csv | stats values(hashes) AS search| format ])
So, the question here is, how can I add the resulting hash values from the previous search into the CSV?
I already try with the following qery with no results:
| foreach * [|append [makeresults | eval hashes=file_hash] | fields hashes | outputlookup Hashes.csv]
Try something like this
index=AV NOT([ | inputlookup Hashes.csv | stats values(hashes) AS search| format ])
| table hashes
| outputlookup append=t Hashes.csv
Try something like this
index=AV NOT([ | inputlookup Hashes.csv | stats values(hashes) AS search| format ])
| table hashes
| outputlookup append=t Hashes.csv