- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are comparing a list of policies (uploaded as a lookup, using "policywithdescs") against our firewall data and determining which policies are NOT being used. Anything with a count of 0 shows us which are not being used. We are using the "policy_id" column in the lookup csv:
index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count by policy_id
| eval count=count-1
| sort count
Now, I have added data to the lookup csv, including zone and description information for each policy. This search above shows the "policy_id", then count. How would I add "Zone" and "Description" to each policy_id to the report?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

if your extra fields are "Zone" "Description"
index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count values(Zone) values(Description) by policy_id
| eval count=count-1
| sort count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

if your extra fields are "Zone" "Description"
index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count values(Zone) values(Description) by policy_id
| eval count=count-1
| sort count
