Hello,
GOAL: determine if application server has logged based on a list of application ID codes
I have 2 csv lookups
Applicationlist.csv - contains: appID , appNAME
Applicationlist.csv is a subset of all applications listed in Applicationmetadata.csv.
appID | appName |
5 | application_five |
24 | application_twentyfour |
35 | application_thrityfive |
120 | application_onehundtwnty |
Applicationmetadata.csv - contains: applicationID, applicationcode, appServerhostname , appServerIP,
applicationID | applicationcode | appServerhostname | appServerIP | |
1 | app1 | webapp101 | 1.2.3.101 | |
1 | app1 | webapp1 | 1.2.3.1 | |
2 | app2 | sql46 | 1.2.4.5 | |
5 | app5 | sql234 | 1.2.5.67 | |
5 | app5 | apach32 | 1.2.5.6 | |
24 | app24 | webapp98 | 1.2.5.98 | |
29 | app29 | sql678 | 1.4.5.6 | |
35 | app35 | webapp35 | 1.7.8.99 | |
35 | app35 | sql909 | 1.7.8.9 | |
120 | app120 | rsatsl | 1.8.9.0 |
*appID = applicationID. same data, different field name in each csv
* each applciation ususlly has more than 1 server
The index being refereed to collects not appserver logs, but server logging data. For example, the original index that the appserver logged to.
Desired results:
..... appmetadata, index(es)/sourcetype(s), Sorted by appID
appID | appNAME | appServerhostname | original_index | original_sourcetype | |
5 | app_5 | hostname_5 | index1 | sourcetype_a | |
24 | app_24 | hostname_24 | index9 | sourcetype_x | |
35 | app_35 | hostname_35 | index11 | sourcetype_z | |
120 | app_120 | hostname_120 | index2 | sourcetype_b |
* original_index and original_sourcetype are fields in the index that are linked to appServerhostname.
Thanks in advance for your help.