How to match the host in host.csv with the field in test.csv?

[jip31]

hi

I need tio match the host there is in host.csv with the field there is in test.csv but i dont succeed

could you help me please?

[| inputlookup host.csv 
    | table host ]
 | lookup test.csv HOSTNAME as host output SITE STATUS 
 | stats values(SITE) as SITE, values(STATUS) as STATUS by host

[gcusello]

Hi @jip31,

did you tried something like this?

| inputlookup host.csv 
| lookup test.csv HOSTNAME as host output SITE STATUS 
| stats values(SITE) as SITE values(STATUS) as STATUS by host

Ciao.

Giuseppe

[jip31]

Hi

Yes but it doesnt work....

[to4kawa · Accepted solution]

sample:

| makeresults count=100
| eval host="host".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random() % 26)
| dedup host
| join host [ | makeresults
| eval _raw="HOSTNAME SITE STATUS
hostZ test good"
| multikv 
| rename HOSTNAME as host]
| stats values(SITE) as SITE values(STATUS) as STATUS by host

@gcusello  's query is good. you should display both csv details and the result.

> it doesn't work
What does it display? Have you check the result before stats?

No one can see your screen but you.

[jip31]

I have done this

| inputlookup host.csv 
| join host 
    [| inputlookup test.csv 
    | rename HOSTNAME as host] 
| stats last(DNS_NAME) as DNS, last(CLIENT_USER) as Client, last(STATUS) as Status, last(DESCRIPTION_MODEL) as Model, last(OS) as OS, last(OS_VERSION) as "OS Version" last(SITE) as Site last(BUILDING_CODE) as Building by host

[spitchika]

While joining 2 queries... try to use join type as inner.

"| join type=inner"

[jip31]

Hi to4kawa

Yes the query works but.....

Du to the fact that there is no subsearch with | inputlookup host.csv, the host displayed in my table dont match the host with the host there is in host.csv.....

I need to display the results only for the host in host.csv.......