hi
I tried to find host from my csv file which have connected in one specific index but never in others
I have done the search below but its what i need because it just exclude events from others indexes
how to do this please??
index="tutu*"
| search NOT (index="toto*" OR index="tata*" OR index="titi*")
[| inputlookup host.csv
| table host]
| dedup host
| table host
Hi jip31,
try something like this:
(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host]
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host
Ciao.
Giuseppe
Hi jip31,
try something like this:
(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host]
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host
Ciao.
Giuseppe
perfect thanks