Search help ?

[splunker969]

When Iam trying to run this search its giving me wrong results .Please correct my search. In my csv is having to coumlmns one is host and other H=YES . Thanks

| metadata type=hosts index=*
| join [| inputlookup watchlist1.csv |search H=YES| rename Host as host]
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host
| sort lastTime
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount

[elliotproebstel]

Are you trying to filter the results of the metadata query to only show hosts from your lookup file that contain YES in the H field? If so, give this a shot:

| metadata type=hosts index=* 
| search 
 [| inputlookup watchlist1.csv 
 |search H="YES"
 | rename Host as host
 | fields host ] 
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host 
| sort lastTime 
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount 

[splunker969]

Hi ellitproebstel ,

Thanks :)Search is working can you help me to find the fully qualified name for host when i search its giving me host name in short cut .

[elliotproebstel]

Do you have the fully qualified name somewhere in your logs or in a lookup?

[splunker969]

logs are having names

[splunker969]

In csv better we need to keep host names as below i got results but in more hosts than csv file .

    host     H
     YY*      YES
      XX*      YES

[splunker969]

Hi Mate,

As we are getting the duplicate results from the csv table and the results are coming with both normal host name and hostname with FQDNS. How do we resolve this and please suggest.

Example:
host
host.com

Thanks.