I have a query which finds hosts without logs for the whole search and it looks like this:
| inputlookup hosts.csv | search NOT [search index=prod ("successfully placed") | dedup host | table host]
What I would like to be able to do is to split this over _time so that I can search for say "over the last 24 hours, which minutes have no logs by host".
I've tested with trying to squeeze in "bucket _time span=1m" but I can't figure out how to combine this with my host.csv lookup.
Anyone got any tips?
... View more