I'm trying to join hosts from a .csv file to the results of this metadata search:
|metadata type=hosts | eval time_diff = now() - lastTime
The .csv file will have some hosts that don't exist in the metadata results but I need to have them show in the final results.
I was thinking a subsearch would work but it fails to match up all the records. I only get about 20 matching records but it does show all records from the .csv.
|inputlookup myfile.csv | fields host | join type=outer host [|metadata type=hosts | eval time_diff = now() - lastTime| table *]
Any suggestions???
Try this
| inputlookup myfile.csv | fields host | append [|metadata type=hosts | eval time_diff = now() - lastTime| table *] | stats first(time_diff) as time_diff by host
Try this,
|inputlookup myfile.csv | fields host | append [|metadata type=hosts |search host=CCFS* | eval time_diff = now() - lastTime| table *] | stats values(*) as * by host
Try this
| inputlookup myfile.csv | fields host | append [|metadata type=hosts | eval time_diff = now() - lastTime| table *] | stats first(time_diff) as time_diff by host
Thanks so much!! That works.