Hi
I currently have a search which returns a list of users with employee id from a user lookup
eg: user lookup has the following information
syyyyyy
sxxxxxx
szzzzzz
My initial search returns syyyyy, sxxxxx but I want the search to return szzzzzz. But my below search is not returning any results
*index=idx_xxxxx sourcetype="cisco:xxx" svc | rename user as identity
| lookup local=true wfh_names_def identity OUTPUT identity, name
| search identity NOT
[| lookup local=true wfh_names_def identity OUTPUT identity, name] *
Could anyone please help
Thanks & Regards
Kavya Dekkata
Do the lookup first, then use join to combine your search results with the base lookup values.
For example,
| inputlookup host.csv | join type=left host [metadata type=hosts]
Doing an individual "| metadata type=hosts" search would give me host "A" and "B". In my csv file, I have "A", "B", "C", "D". Doing the above query would give me everything in my lookup file.