Hello
I dont understand why my "where" condition doesnt work
could you help me please?
| inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 |where HealthState00 > 99 | stats count by host
But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?
| inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population
But i have something strange again
I m doing where HealthState00 < "95,00"
It well displays resulst < to 95 but also events with HealthState00 = 100!
why?
| inputlookup host.csv
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00 | where HealthState00 < "95,00"| table host HealthState00 population
I found!
I added brackets like this where HealthState00 > "90,00"
@jip31 Just remove stats count by host and see if it gives you any results.
when I m doing | inputlookup host.csv
I have results
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
Does your PanaBatteryStatus.csv lookup has field called Hostname00
and host.csv has a field host
?
Yes for both
Ok.. Does the field values match exactly (by default the lookup match is case sensitive) between two lookup table files (Hostname00
from PanaBatteryStatus.csv and host
from host.csv)? Also, when you say the where condition doesn't work, does it not filter the data OR it's filtering all data?
yes they match exacly
when I add the where conditions I have any results
add 'host' after OUTPUT as you are using in stats
when I m doing | inputlookup host.csv
I have results
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT HealthState00
but if I add host after output, I have no results