searchmatch function

[surekhasplunk]

Hi

I am trying to find an ip from first query and then search that ip if exists in another csv file and show the count of only those ips

| inputlookup asset_list.csv 
| search "Infrastrucure Name"="xyz" | eval main_ip=IP [| inputlookup ip_exist.csv  |  eval test=if(searchmatch("IP=$main_ip$"), "yes", "no") | table IP test | where test="yes" ]

But i am getting error in the eval function.
please help.

[renjith_nair]

@surekhasplunk,

Try

 | inputlookup asset_list.csv |eval source="asset"
 | search "Infrastrucure Name"="xyz" |append [| inputlookup ip_exist.csv|eval source="exist" ]
 | stats count,values(source) as source by IP|where mvcount(source) > 1

If you have different field names for IP in the csv, rename one of them
If you have unique IPs in both files, stats ccount by IP|where count >1 also should work