Hi,
I have a list of hosts/devices say from HostA to HostZ (PS: its not a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.
Could someone help me on this?
if you can define hosts using a wildcard (as in your example hostA to hostZ):
| metasearch index=IndexA host=host* | stats values(host) AS host
if host* is to broad then you can restrict it with | where host IN or similar
Hi @Woodpecker,
putting the list of hosts in a lookup is the easiest way to solve your problem.
If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:
index=indexA host IN (hostA, hostB, hostC ...,hostZ
| ...
even if the lookup is the best solution!
Ciao.
Giuseppe
If the list of hosts is not a lookup file then in what form is it? That will make a difference in the search.