Custom Splunk query

[Ash1]

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes

Form the above query i am getting the results of service and application_codes.

But my requirement is to get the application_codes from a csv file and  from only type=error1

below is the csv file

application_codes	Description	Type
0	error descp 1	error1
10	error descp 2	error2
10870	error descp 3	error3
1206	error descp 1	error1
11	error descp 3	error3
17	error descp 2	error2
18	error descp 1	error1
14	error descp 2	error2
1729	error descp 1	error1

[yuanliu]

For this problem, using the lookup in subsearch is more direct and potentially more efficient.

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes
| search type = error1
  [inputlookup app.csv]

[ITWhisperer]

Try lookup of application_codes in csv and then filter by type

[Ash1]

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes
|lookup app.csv  application_codes

when i run the above query i am getting application_codes from mstats query not from csv file

[ITWhisperer]

Please can you give an example of your expected results?

[Ash1]

application_codes

0

1206

18

1729

i want to see only the above application codes, that is from csv file only.

[ITWhisperer]

If you just want the application codes, why are you doing the mstats?

| inputlookup app.csv
| where Type="error1"
| table application_codes