Hi @fishn To match the partial string in the lookup (e.g. poda) with the data (e.g. "poda-284489-cs834"), you need to append each of the pod_name_lookup values with a wildcard asterisk, i.e. poda*,...
See more...
Hi @fishn To match the partial string in the lookup (e.g. poda) with the data (e.g. "poda-284489-cs834"), you need to append each of the pod_name_lookup values with a wildcard asterisk, i.e. poda*, podb*, podc* Then, add a lookup definition with the following setting, under the Advanced options checkbox: Then in your search: (where lkp_pod_name is your lookup definition) | lookup lkp_pod_name pod_name_lookup as pod_name --- Next, to show which pods are missing and their importance, you can do it like this: index=abc sourcetype=kubectl
| eval Observed=1
| append
[| inputlookup lkp_pod_name
| eval Observed=0 ]
| lookup lkp_pod_name pod_name_lookup as pod_name OUTPUT pod_name_lookup
| stats max(Observed) as Observed by pod_name_lookup, importance
| where Observed=0 --- Finally, to count how many critical and non-critical pods are not found as well as table the list of missing pods, you can append this line to the above search: | eventstats count as count_by_importance by importance