hi
I need tio match the host there is in host.csv with the field there is in test.csv but i dont succeed
could you help me please?
[| inputlookup host.csv
| table host ]
| lookup test.csv HOSTNAME as host output SITE STATUS
| stats values(SITE) as SITE, values(STATUS) as STATUS by host
sample:
| makeresults count=100
| eval host="host".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random() % 26)
| dedup host
| join host [ | makeresults
| eval _raw="HOSTNAME SITE STATUS
hostZ test good"
| multikv
| rename HOSTNAME as host]
| stats values(SITE) as SITE values(STATUS) as STATUS by host
@gcusello 's query is good. you should display both csv details and the result.
> it doesn't work
What does it display? Have you check the result before stats?
No one can see your screen but you.
Hi @jip31,
did you tried something like this?
| inputlookup host.csv
| lookup test.csv HOSTNAME as host output SITE STATUS
| stats values(SITE) as SITE values(STATUS) as STATUS by host
Ciao.
Giuseppe
Hi
Yes but it doesnt work....
sample:
| makeresults count=100
| eval host="host".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random() % 26)
| dedup host
| join host [ | makeresults
| eval _raw="HOSTNAME SITE STATUS
hostZ test good"
| multikv
| rename HOSTNAME as host]
| stats values(SITE) as SITE values(STATUS) as STATUS by host
@gcusello 's query is good. you should display both csv details and the result.
> it doesn't work
What does it display? Have you check the result before stats?
No one can see your screen but you.
I have done this
| inputlookup host.csv
| join host
[| inputlookup test.csv
| rename HOSTNAME as host]
| stats last(DNS_NAME) as DNS, last(CLIENT_USER) as Client, last(STATUS) as Status, last(DESCRIPTION_MODEL) as Model, last(OS) as OS, last(OS_VERSION) as "OS Version" last(SITE) as Site last(BUILDING_CODE) as Building by host
While joining 2 queries... try to use join type as inner.
"| join type=inner"
Hi to4kawa
Yes the query works but.....
Du to the fact that there is no subsearch with | inputlookup host.csv, the host displayed in my table dont match the host with the host there is in host.csv.....
I need to display the results only for the host in host.csv.......