I have an index named "Linux" and a CSV file called "sample.csv" with multiple columns, including "IP" and "Host."
My objective is to retrieve the host values from the index data that match the host values in the CSV file.
In the index data, the host values encompass not only host names but also IP addresses and hosts with DNS information. Conversely, the host values in the CSV file solely consist of host names. I need to utilize the "mvappend" function for ip and host, which is fine)
However, my concern pertains to obtaining results that match the host values in the CSV file, similar to the way we construct search queries. For instance, if we were to search "index=linux host1 OR host2," it would return values that match the host names in the raw data, such as "host1.dns.com" and so on. Yet, when matching with the CSV file, it searches for the entire host name in the file.
... View more