compare output of a search to a lookup file

[aalaa]

Hello ,

I have a csv lookup file that contains all Oracle services, at the same time I have a search that gives me the active services now, I need to know what the service is missing in the result of search on comparison by the csv files.

Any help please?

[gcusello · Accepted solution]

Hi aalaa,
if the field is called "service" both in index and in lookup, try something like this:

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| where Total=0

In this way you have al the missing services.

If you want to list all the services displayng status, you have to replace the last row with

| eval Status=if(Total=o,"Missing","Present")
| table service Status

Bye.
Giuseppe

[aalaa]

This search return the list of service in the csv file :

index=my_index
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total BY service
| eval Status=if(Total=o,"Missing","Present")
| table service Status

I want to display the name of service that not actif now

[gcusello]

Hi aalaa,
to display the list of not active services, you have to use the first choice (the one with | where Total=0 ) because the condition to identify not present services is that these services are in the lookup table (count=0) but not in the index (count>0).
Bye.
Giuseppe