Field not in logs but we need it from csv

[ksharma7]

I am using the below query :

index=rxc  sourcetype="rxcapp" type=ERROR [| inputlookup abc.csv | rename id as i_d | fields i_d] | stats count by i_d type description

Now question is I have abc.csv which has columns id and name, for one name there are many unique id available.

In my logs, the only id is getting logged as i_d so I have used the above query but I want to get count by name instead if id from my logs and name is not getting logged, is there any way I can do that?

[bowesmana · Accepted solution]

Once you have the table

i_d type description count

you could do

|lookup abc.csv id as i_d

and that would then add the column name to the table. If you then want to count by name you can then do

| stats sum(count) as count by name

which will give you name, count

but at that point you will lose type and description, so it depends what you want to do with those fields. You can of course do

| stats sum(count) as couny by name, type, description

 and you could also add in the unique values of id with

| stats sum(count) as count list(id) as ids by name, type, description

Hope this helps.

[ksharma7]

Yep worked. Thanks