How to use a lookup to validate hosts against metadata

[a212830]

Hi,

Is it possible to create a lookup, and then validate that data has been received from each host in the lookup by comparing it againsts metadata?

[somesoni2]

Something like this should do it.

| inputlookup yourlookup.csv | eval recentTime=0 | append [| metadata type=hosts index=* | table host recentTime ] | stats max(recentTime) as recentTime by host | eval Result=if(recentTime=0,"Not Received","Received") | convert ctime(recentTime)

[a212830]

Thanks. Shows data that is "Received", but none that aren't. Should be missing about 30 or so...

My lookup has 195 entries, and this returns 166 events. All of them "received".

[a212830]

And, just to be clear, some of these might have never sent events.

[sloshburch]

Sounds like you have duplicates in your lookup file.

Do this to see:

 | inputlookup yourlookup.csv
 | stats count, dc(host) AS unique_hosts

If count and unique_hosts are not equal then find your duplicates:

 | inputlookup yourlookup.csv
 | stats dc(host) AS unique_hosts by host
 | where host>1

[HiroshiSatoh]

How about this?
ex.
lookup(my_hosts_list.csv):all
metadata:Match only

| inputlookup my_hosts_list.csv | join type=left host [| metadata type=hosts|eval match="true"|table host match]