Using a Lookup with wildcard to check on logging status

[alferone]

Hello all, 

I have a lookup with a single column that lists source file names and paths.  I want to search an index and lookup the sources, then show the latest time of those sources.  I also want to show if a file hasn't logged at all in a given timeframe.

I set the lookup to use WILDCARD() in the lookup definition, but I am now struggling with the search.

I basically want the search to lookup each source file, then search the index and tell me what the latest time of the log is, as well as show a "No Logs Found" if source doesn't exist.

I was toying with this, but the wildcards aren't working, and I think it is because I am not using the definition.  But even so, I can't wrap my ahead around the search.

| inputlookup pvs_source_list
| join type=left source 
    [| search index=pvs
    | stats latest(_time) as TimeAx by source]

Thank you!

[ITWhisperer · Accepted solution]

Assuming you lookup has a column called source, try something like this

index=pvs [| inputlookup pvs_source_list | table source]
| stats latest(_time) as TimeAx by source

[alferone]

My goodness.  That is exactly what I am looking for.  I should've known that!  I was definitely over complicating it.  THANK YOU!!

How would I be able to list the files in the lookup that are NOT logging?

[ITWhisperer]

Not so easy, because you have said your lookup contains wildcards, you could append the list of sources from your lookup and count the occurrences, but you might get false positives/negatives where you found a source which matched the wildcard

| append [| inputlookup pvs_source_list | table source]
| stats count by source
| where count < 2

[alferone]

Understood.  Thanks again!