I am trying to do a tstats command to get the last logged time a server has sent logs. My server list i want in the table is in a lookup csv.
The command i am using is
Tstats latest(_time) as lastseen where (index=windows) by host | convert ctime(lastseen)
The "where" clause i would like to be something like "where the server name is on the lookup table"
Basically trying to filter the output of the query to just any server i have in the lookup table
Use a subsearch.
| tstats latest(_time) as lastseen where (index=windows) [ | inputlookup hostlist.csv | fields host | format ] by host
| convert ctime(lastseen)