Thanks! That worked for me, I was messing up the syntax of calling the lookup. I've accepted this as the solution, but I have a follow up question if you'd be so inclined. Say I want to take it a step further and be able to list multiple hosts and be able to wild card. Like this for example: host Name severity failuresAllowed server123::server234::server345 Service1 low 3 server1* Service2 high 1 server123 Service3 medium 2 This works for the 2nd and 3rd row. Note that I'm doing my lookup by host and Name because certain servers could be looking at the same services with different severities resulting if it's stopped. index=windows source=service earliest=-20m
[inputlookup Windows_App_Services.csv | table host Name | makemv delim=:: host | mvexpand host]
| stats count(eval(if(State!="Running",1,null()))) as failureCount by host Name
| lookup Windows_App_Services host Name OUTPUT severity failuresAllowed However I'm not sure how to split out the hosts in the first row as this doesn't quite do it. index=windows source=service
[inputlookup Windows_App_Services.csv | table host Name | makemv delim=:: host | mvexpand host]
| stats count(eval(if(State!="Running",1,null()))) as failureCount by host Name
| lookup Windows_App_Services_Lookup host Name | makemv delim=:: host | mvexpand host I'm at a point where I could probably bang my head against a wall for a little and figure it out, but any advice would be much appreciated!
... View more