I have a list of events about patches installed on my hosts (about 3k) which look like
Hostname1, PatchId1 Hostname1, PatchId2 Hostname2, PatchId2 Hostname2, PatchId3
Also I have lookup with list of patches which should be installed on each hostname.
I know that some are hosts missing some patches and I need to find which hosts are missing which patches.
Please help me to understand a way how to do this.
Simple - do an inputlookup of your csv and NOT that with the search that produces your list of installed patches. That should give you the entries which are in the csv but not in the data of your index.
It should look something along the lines of
| inputlookup your_csv NOT [search your_search | table name, patch]
Try the subsearch alone with a
| format at the end to see how the result is passed to the NOT of the inputlookup - it's a simple ((name=x AND patch=y) OR (name=a AND patch=b) ... ), which is exactly what you want for your NOT.
Of course this only works if the column names are the same in your csv and the search, but that can easily be done with a rename if neccessary.