multisearch with a lookup and index?

[msage]

I'm looking to combine data from a lookup file to data from our security server to create a comparison chart between how many alarms we get (security server) and how many of those are acknowledged (lookup file). I figured multisearch was the way to go but I'm getting errors when using it. The search is below. The reason for the eval Date fields are because one column contains dates so I needed to get them in the right order since they were always out. The end goal is a daily chart showing x alarms and y acknowledgements. 

| multisearch

    [| inputlookup genericlookupname.csv
| eval Date=strptime(Date,"%m/%d/%Y")
| sort Date
| eval Date=strftime(Date,"%m/%d/%Y")]
    [search index=index EVDESCR="alarm"]

[manjunathmeti]

hi @msage,

Try this:

index=<provide_index_name> EVDESCR="alarm" 
| append [ | inputlookup genericlookupname.csv ]
| eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y"))
| stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index!="<provide_index_name>")) as acknowledgements by Date

[msage]

Hey @manjunathmeti ,

I tried this but unfortunately the lookup data always stays at 0. 

[manjunathmeti]

Does genericlookupname.csv has Date field?

[msage]

It does yes

[manjunathmeti]

Try this:

index=<provide_index_name> EVDESCR="alarm" 
| append [ | inputlookup genericlookupname.csv | eval index="mycsvdata" ]
| eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y"))
| fields index, Date
| stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index="mycsvdata")) as acknowledgements by Date

If this reply helps you, a like would be appreciated.