I setup testing.csv lookup as following
host,location
123,HK
234,US
345,UK
I would like to basic search if host matched in the log, stats count by location
index=log sourcetype=csv |search [|inputlookup testing | return $host]
| stats .... by location
But seems return nothings
Hi @keyu921,
the command to use is lookup, try something like this:
index=log sourcetype=csv
| lookup testing.csv host OUTPUT location
| stats count by location
Remember to define Lookup definitions.
Ciao.
Giuseppe
index=* sourcetype=csv |search [|inputlookup testing| return 1000 $host]
| stats last(Size) last(Used) last(Use) by host
Hi @keyu921,
the command to use is lookup, try something like this:
index=log sourcetype=csv
| lookup testing.csv host OUTPUT location
| stats count by location
Remember to define Lookup definitions.
Ciao.
Giuseppe
thanks seems i mix up inputlookup and lookup