Unable to get the lookup values on the search queries

[Nagalakshmi]

Hi Team,

Need your assistant for below 

We have created new csv lookup and we are using the below query but we are getting  all the data from the index & sourcetype . we need to get the events only for the hosts which mentioned on the lookup is the requirement

Lookup name : Palo_devices.csv, used only one column called Hostname

index=security host=abc sourcetype = Palo

|lookup Palo_devices.CSV Hostname OUTPUT Hostname

Regards,

Nagalakshmi 

[Nagalakshmi]

Hi @gcusello ,

Yes, Hostname field is already exists in the event. Thank you for quick response! Mentioned query is a perfect solution for this issue.

Regards,

Nagalakshmi A

[gcusello · Accepted solution]

Hi @Nagalakshmi ,

you can use your search only if in the main search you have the field youused as key (in your case "Hostname"), have you this field in the main search?

Anyway, if you want to filter the results of a search for the results of a lookup, you have to use a subsearch like the following, putting attention that the field name in main and sub search is the same.

So if in the lookup ho have a column called Hostname and in the main search there's a field called Hostname, you can run something like this:

index=security host=abc sourcetype = Palo [ | inputlookup Palo_devices.CSV | fields Hostname ]
| ...

 Ciao.

Giuseppe