How to match host fields between two separate lookups?

[spluzer]

Hello all,

I have two lookups-- lookup1.csv with a "host" field and lookup2.csv with a "Host" field

I want to see if any hosts match 

Pretty silly, but IM blanking on this for some reason 

here is how I was doing it, but it doesn't seem to find the hit (even when I add it in a matching host purposefully for testing)

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| appendpipe [ | inputlookup lookup2.csv ]
| table host Host
| eval results = if(match(upper(Host),upper(host)), "hit", "miss")
| table host Host results

[richgalloway]

If you put two lists of names next to each other, what are the chances two names in the same row will match?  That's what's happening here.

Appendpipe is the answer to a rare set of problems.  This is not one of them.

Pick one lookup as the base and use the lookup command to see if the name exists in the other file.  The command is case-insensitive so no need to shift case when comparing.  If the name doesn't exist in the 2nd file then the lookup command will return NULL.

| inputlookup lookup1.csv
| rex field=host "(?<host>[^.]+)\."
| dedup host
| lookup lookup2.csv Host as host OUTPUTNEW Host
| eval results = if(isnotnull(Host), "hit", "miss")
| table host Host results