I have lookup file with host and count fields as below
Now i will get top 5 host counts from log events as below
index=main | top 5 host | table host count.
Now i want to update these top command results in csv and sum them and get final top 5 host count.
Final output should be in lookup file for further usage:
@srinivasup... Were you able to try out any one of the following options?
index=main | top 5 host | table host count | appendpipe [|inputcsv host.csv] | stats sum(count) AS count BY host | outputcsv host.csv
Try something like following with accum. Streamstats will also allow you to achieve the same.
index=main [inputlookup host.csv | table sourcetype]
| lookup host.csv host OUTPUT count as csvCount
| stats count as indexCount values(csvCount) as csvCount by sourcetype
| sort -indexCount
| eval counter=1
| accum counter
| eval count=if(counter<=5,indexCount+csvCount,csvCount)
| table sourcetype count
| outputlookup host.csv