If I have a lookup table formatted like this:
lookup_host,os
host1,linux
host2,linux
host3,sunos
And say I'm sending data to: source=/data/unix/syslog.log
In my search, I can do som...
See more...
If I have a lookup table formatted like this:
lookup_host,os
host1,linux
host2,linux
host3,sunos
And say I'm sending data to: source=/data/unix/syslog.log
In my search, I can do something like:
source=/data/unix/syslog.log os=linux ... and that correctly shows me everything received from host1 and host2 ...
But, I'd like to be able to use the lookup table to tell me who's not sending me data.
Not quite sure how I would format a search to do that.
Thanks very much, hopefully I made this fairly clear ...
Paul Keller