How to get only the license usage of hosts in that lookup file?

[vpantangi]

Hi,
I can see the license usage of hosts in my environment by using this query:

index=_internal source=*license_usage.log type=Usage
 | stats sum(b) AS Bytes by h
 | eval GB = Bytes/1024/1024/1024
 | rename h as host
 | table host GB
 | sort -GB
 | addcoltotals

but i have to calculate only the license usage of dev environment hosts, i have created a lookup as dev.csv, but i am not sure how to get only the license usage of hosts in that lookup file.

[richgalloway]

Try this.

index=_internal source=*license_usage.log type=Usage [|inputlookup dev.csv | fields host | format]
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| rename h as host
| table host GB
| sort -GB
| addcoltotals

[aknsun]

Am I missing something? I tried something similar, but it doesn't seem to return any data when using the lookup. My lookup has just 2 columns

host        DC
Host1     AWS
Host2     AWS
Host 3   OnPrem

Using what you mentioned earlier.

index=_internal source=*license_usage.log type=Usage [|inputlookup DataCentre.csv | fields host | format]
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| rename h as host
| table host GB
| sort -GB
| addcoltotals

[vpantangi]

No results found.