how to iterate a column's values like python in command?

[cyberportnoc]

"daily.cld" | rex field=_raw "version: (?\d+.)," | rex field=_raw "sigs: (?\d+.)," | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table source, date, version, sigs | where date=strftime(now(), "%Y-%m-%d")

is there a command like python to find missing server log file?

input a correct full list of name ["name1", "name2", "name3"]
and compare with the columns values , to find which name in full list not in the values of columns of search table

[gcusello · Accepted solution]

Hi cyberportnoc,

create a lookup with all your servers (e.g. perimeter.csv) calling column host and possibly using only uppercase (not mandatory)
run this search:

your search
| eval host=upper(host)
| stats count by host
| append [ | inputlookup perimeter.csv | eval host=upper(host), count=0 | fields host count ]
| stats sum(count) AS Total by host
| where Total = 0

In this way you listed all missing hosts.
without the last condition (where Total=0) you have the status of all your servers that you can display in a dashboard also in graphic mode.

Bye.
Giuseppe