Hello, I have a csv file which contains 12 columns and i want to use the values of the columns as arguments in my search.  i thought the best way to achieve it will be with macro that will read the file but im not sure how to do it.  maybe there is another way ? i also tried this query :     [| inputlookup concurrency_rules.csv | fields Used* | transpose | rename "row 1" as eventtype | fields eventtype] | transaction maxpause=2s maxspan=1s maxevents=5 | eval max_time=(duration + _time) | eval min_time=(_time) | rename kafka_uuid as uuids | where eventcount!=5 | table eventtype ,min_time, max_time,tail_id,uuids     it is working but not dynamic as i wanted. the file supposed to have more than 1 row so the rename of row 1 is not good enough and also not all the values  in row 1 are eventtypes. also i have more fields there that i want to use as arguments thanks for the help ... View more

Hello, I have this query: index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared" | transaction maxpause=2s maxspan=2s maxevents=5 | eval Max_time=(duration + _time) | eval Min_time=(_time) | table _time,eventcount, eventtype ,Min_time, Max_time,tail_id,kafka_uuid | foreach eventtype [eval flag_eventtype=if(eventcount!=5,"no", "yes")] now i have a lookup table and i want to set parameters in my query that will be taken from the lookup table. for example , instead of searching eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared" i want to take the values of the eventtype from the lookup table how can i do that ? thanks ... View more

Hello I'm running this query: index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared" | transaction maxpause=2s maxspan=1s maxevents=5 | eval max_time=(duration + _time) | eval min_time=(_time) | rename kafka_uuid as uuids | where eventcount!=5 | table eventtype ,min_time, max_time,tail_id,uuids | eval eventtype="csm_dhcp_anomaly" now i have csv file and i want to read the "eventtype" parameters from there. how can i call inputlookup ? all of my tries didn't work.. thanks ... View more

hello im trying to calculate min and max time of event (the time when the event started and when its ended) when im adding my calculation to the query im loosing the results of the rest of the query and getting only the result of the time calculation... what am i missing ? index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared" | transaction maxpause=2s maxspan=1s maxevents=5 | stats first(_time) as min_time, last(_time) as max_time | table _time,eventcount, eventtype, tail_id, kafka_uuid,min_time,max_time | foreach eventtype [eval flag_eventtype=if(eventcount!=5,"no", "yes")] ... View more

Hello i have a raw with 5 columns from the same type and i want to compare the value of the cells of this 5 columns. how can i do it ? thanks ... View more