How to create a search where if results under "query" field matches anything under hostname, then alert or show results?

[YangThomas]

Currently using splunkes' managed lookup table called hosts. There's a field too called hostname within the file.

I'm trying to create a search where if results under "query" field matches anything under hostname, then alert or show results.

here's what I have so far..

index=opendns
[ | inputlookup hosts
| search hostname
| table hostname query]

[gcusello]

Hi @YangThomas,

in a subsearch you have to use the exact fieldnames of the main search, in other words i you want to match the hostname field (in the lookup) with the host field in the search, you have to rename it.

I don't understand what you want to match with the "query" field, also because query is a special name in SPL, anyway if query is a field both in the lookup and the main search, you could try something like this:

index=opendns
[ | inputlookup hosts
| rename hostname AS host
| table host query]

Ciao.

Giuseppe