Looking to improve a query with a lookup file

[bond77s]

I have a lookup file that contains a column for hostname, ip address and location.  I need a query that will check the lookup file and determine if the element is up or down and if it has or used "radius".

|inputlookup filename | search (MESSAGE_TEXT="Radius")

[gcusello]

Hi @bond77s ,

not having your search (as also @isoutamo said) it's difficoult to help you, at least, please better describe your requirements.

anyway supponing that you have a search and you want to check if the hostname from the search is listed in the lookup and that MESSAGE_TEXT is a field in your main search and yu want only the events with this condition, you could try something like this:

index=your_index MESSAGE_TEXT="Radius" [ |inputlookup filename | rename hostname AS host | fields host ]
| ...

Then, if in your main search you have also a field called ip and you want to check both host and ip, you could try something like this:

index=your_index MESSAGE_TEXT="Radius" ([ |inputlookup filename | rename hostname AS host | fields host ] OR [ |inputlookup filename | fields ip ]

Ciao.

Giuseppe

[isoutamo]

Can you add your whole SPL query here, as @ITWhisperer said, your example didn't contains any fields which have value Radius.

[ITWhisperer]

If your lookup only contains hostname, ip address and location, how will you find any events where MESSAGE_TEXT="Radius"?