Lookup Configured, Now I Need More Fields...

[aferone]

We are comparing a list of policies (uploaded as a lookup, using "policywithdescs") against our firewall data and determining which policies are NOT being used. Anything with a count of 0 shows us which are not being used. We are using the "policy_id" column in the lookup csv:

index="summary" policy_id=* 
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count by policy_id 
| eval count=count-1 
| sort count 

Now, I have added data to the lookup csv, including zone and description information for each policy. This search above shows the "policy_id", then count. How would I add "Zone" and "Description" to each policy_id to the report?

Thanks!

[yannK · Accepted solution]

if your extra fields are "Zone" "Description"

index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count values(Zone) values(Description) by policy_id
| eval count=count-1
| sort count