Hi,
My issue is :
I have a query which contains a "NetworkIterface" field: eni-12345, eni-6789, ...
I have a lookup which contains the list of network interfaces whose ip are public:
I want to be able to create a request which, by combining the search and the lookup, only shows the network interface whose ip are public only.
I have a lookup like that :
ENI | Public IP |
eni-1234 | 192.10.10.10 |
eni-5678 | 192.10.10.11 |
eni-9012 | 192.10.10.12 |
My search is basic :
Index=abc sourcetype=xyz NetworkInterface=*
Thanks for your help !
Hi @mah ,
This should work:
| makeresults
| eval ENI = "eni-1234 eni-9012 eni-9013 eni-9015"
| makemv ENI
| mvexpand ENI
| lookup pubip.csv "ENI" OUTPUT "Public IP" as IP
| where IP!=""
You only need the lines starting with the lookup command. The ones above that are just to create some sample data.
Sidenote: I recommend to output your "Public IP" field as "IP" (or maybe "PublicIP"), because spaces in field names cause issues. I could not get the "where" command to work correct with "Public IP" as fieldname...
Hope it helps.
BR
Ralph
--
Karma and/or Solution tagging appreciated.
Hi @mah ,
This should work:
| makeresults
| eval ENI = "eni-1234 eni-9012 eni-9013 eni-9015"
| makemv ENI
| mvexpand ENI
| lookup pubip.csv "ENI" OUTPUT "Public IP" as IP
| where IP!=""
You only need the lines starting with the lookup command. The ones above that are just to create some sample data.
Sidenote: I recommend to output your "Public IP" field as "IP" (or maybe "PublicIP"), because spaces in field names cause issues. I could not get the "where" command to work correct with "Public IP" as fieldname...
Hope it helps.
BR
Ralph
--
Karma and/or Solution tagging appreciated.