Help on basic question concerning lookup command

[jip31]

Hello

I have a stranfge behavior concerning the search below

In the "host_allIND.csv" file, I have just HOSTNAME from a specific type which is "Type 1"

But when I run the search below, I have also HOSTNAME with type = "Type 2"

How is it possible to have events with HOSTNAME= Type 2 even if in "host_allIND.csv" lookup I have only HOSTNAME=Type 1?

`boot` 
| fields host BootTime 
| lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY 
| stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

 Thanks

[richgalloway · Accepted solution]

We don't know what the boot macro does, but nothing else in the query limits the results to a particular host.  The lookup command adds three fields, but does not filter the results.  If "Type 2" is not in the lookup file then the SITE, DEPARTMENT, and CATEGORY fields will be null.

To filter out the "Type 1" hosts, use a where command or put the desired host into the base query.

`boot` host="Type 2"
| fields host BootTime 
| lookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY 
| stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host

[jip31]

thanks but  I thought that in so far as I stats my events with "by host", it just reuses the host existing in my CSV file.....

[aasabatini]

Hi,

Please can you explain better what you mean with type 1 or type 2?

anyway you can try to modify the lookup or use a subsearch to modify the output.