How to create a search to combine inputlookup and search?

[doniv]

Hi,

I want to compare the count of calls obtained in a day with the target in lookup csv,

for example:

input csv:

header: label hr1, hr2,hr3,......hr24

row1: LA, 1,2,1,5.....6

search: date hour:

index=foo | stats count by Label date hour

output: LA, 0,0,0,...5

Expected output:

	count(from lookup file)	count(from search)	Passed
LA	1	1	pass
OA	2	1	fail

Can someone me in writing the code combining search and input lookup?

[doniv]

| lookup lookup.csv Label Hour is not showing any results...am i missing anything?

But |inpulookup lokup.csv display the content of csv

[ITWhisperer]

Possibly field name mismatches? (Fieldnames are case-sensitive)

Possibly field contents mismatch? (Lookups are usually set up as exact matches)

[doniv]

I can manage to bring it for hourly basic, if i can able to do it for aggregated way..

Count of LA in inputlookup is 1 it should match with the search else it is fail

[ITWhisperer]

This is still not clear what you are trying to do

If you can change your lookup so it is like this:

Label	Hour	LookupCount
LA	1	1
LA	2	3
etc.

Then you can do

| stats count by Label Hour
| lookup lookup.csv Label Hour
| eval Passed=if(count==LookupCount,"pass","fail")

[ITWhisperer]

Your expected output no longer has date or hour - is the hour no longer important?

Your csv appears to have columns for label and each hour but your search stats command will return columns with label, date, hour and count - are you able to rework your csv so it matches your search?

[doniv]

I will work on the recommends suggested today and let you know