Sorry I missed the definition here. This is easily fixable index=owner ``` where source != host.csv ```
| rename ip as ip_address
| append
[inputlookup host.csv
| eval source = "host.csv"]
| st...
See more...
Sorry I missed the definition here. This is easily fixable index=owner ``` where source != host.csv ```
| rename ip as ip_address
| append
[inputlookup host.csv
| eval source = "host.csv"]
| stats values(owner) as owner values(source) as source by host ip_address
| where source == "host.csv"
| fields - source Here, I am back at using the side effect of Splunk's multivalue equality. Here is the full emulation | makeresults format=csv data="ip, host, owner
10.1.1.3, host3, owner3
10.1.1.4, host4, owner4
10.1.1.5, host5, owner5"
| eval source = "not-host.csv"
``` the above emulates
index=owner
```
| rename ip as ip_address
| append
[makeresults format=csv data="ip_address, host
10.1.1.1, host1
10.1.1.2, host2
10.1.1.3, host3
10.1.1.4, host4"
``` the above emulates
| inputlookup host.csv
```
| eval source = "host.csv"]
| stats values(owner) as owner values(source) as source by ip_address host
| where source == "host.csv"
| fields - source