I have a lookup table that runs every month of previous successful logins. For example:
alpha, comp1 comp2 comp3
bravo, comp1 comp3
Now I have a scheduled report to run daily to determine any differences between the lookup file and account names and hosts of new daily logons. So, for example, if the new data is...
I want my new lookup table to compensate for this. New result set will be as follow:
alpha, comp1 comp2 comp3 comp4 comp5
bravo, comp1 comp2 comp3
charlie, comp1 comp2
How do I write the outputlookup portion to append the new data to the old data in the lookup file?
My query is as follow to obtain new data:
index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host
index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv
View solution in original post
Are you guys sure of this method with tstats?
| tstats count where (index=test* earliest="2/1/2020:00:00:00" latest="3/1/2020:00:00:00") BY _time span=1d | inputlookup append=true testlookup.cvs | outputlookup testlookup.csv
search blah | inputlookup append=true X.cvs | outputlookup X.csv