Hello
The join comamnd below truncate events because I have results if I execute the ode before the join command but I havent results if I execute the second part
Considering that my company dont want to increase the subsearch limit, which other solutions I can apply please??
| inputlookup lookup_patches
| search Standard_PC=1 AND StateName="Non-Compl"
| search OSVersion="*"
| search HOSTNAME=302013154
| join HOSTNAME
[| inputlookup lookup_fo_all
| fields SITE RESPONSIBLE_USER DEPARTMENT HOSTNAME BUILDING_CODE ROOM TYPE CATEGORY STATUS ]
| stats last(SITE) as Site, last(BUILDING_CODE) as Building, last(ROOM) as Room, last(RESPONSIBLE_USER) as Responsible, last(DEPARTMENT) as Department, count by HOSTNAME FileName StateName OSVersion
hi @jip31,
You use lookup command:
| inputlookup lookup_patches where Standard_PC=1 StateName="Non-Compl" OSVersion="*" HOSTNAME=302013154
| lookup lookup_fo_all HOSTNAME OUTPUT SITE RESPONSIBLE_USER DEPARTMENT BUILDING_CODE ROOM TYPE CATEGORY STATUS
| stats last(SITE) as Site, last(BUILDING_CODE) as Building, last(ROOM) as Room, last(RESPONSIBLE_USER) as Responsible, last(DEPARTMENT) as Department, count by HOSTNAME FileName StateName OSVersion
If this reply helps you, an upvote/like would be appreciated.
hi
I have done this but performances are very bad because I have more than 60000 devices....