Comparing index with inputlookup?

[danutmatei]

Hi,

I have a policy.csv file with 2 columns:

user                   tags

Andre               IT

Kleo                  Management

Vlad                  Finance

And I also have an index=events with events and field "user"

What I want is to count the number of events for each tag by user.

for example:

User          Tags         Count

Andre         IT           55

I've tried this, but it counts the number of rows from the csv, not from index:

|inputlookup policy.csv
| join type=left tags [|tstats count where index=events by user]
|stats count by user tags

[danutmatei]

Error in 'lookup' command: Must specify one or more lookup fields.

[ITWhisperer]

Sorry, try it this way

|tstats count where index=events by user
| lookup policy.csv user

[danutmatei]

bot working, I get 0 statistics

[ITWhisperer]

What is your current search?

[danutmatei]

|tstats count where index=events by user
| lookup policy.csv user

[ITWhisperer]

Does this return any results?

|tstats count where index=events by user

If not, how about this

index=events
| stats count by user

[danutmatei]

And what should I do with this query ? since is not solving my issue and the lookup file is not included ?!

[ITWhisperer]

If you are not getting any results from the tstats or the stats, then the lookup isn't going to make any difference. You need to look at why there are no results. Perhaps the fields don't exist or are spelt differently, including differences in upper and lower case.

[ITWhisperer]

Would this work for you?

|tstats count where index=events by user
| lookup policy.csv

[danutmatei]

no

[ITWhisperer]

In what way does it not work? What else can you tell us about your data which might help us suggest a more meaningful solution?