Hi,
I am using splunk enterprise 9.0.5.1 since about a month and have been experimenting with a dashboard (studio) for application insights. I am now trying to get nfs info in my dashboard, because the nfs shares don't have logical names i have created a simple, small lookup csv with 2 fields app-name and nfs-name.
This is working fine :
index=summary type=isilon_nfs-quota-alert (path="*appsdata*")
| lookup apps-nfs.csv nfs-name as path output nfs-name as found, app-name as application
| where isnotnull(found)
| table path, found, application, quota
it fetches all the nfs info from all the nfs'es in my apps-nfs.csv
But.... I don't want the entire list...
I want to use a filter in my apps-nfs.csv first on app-name and can't get that to work. Eventually i want to use the app-name token of my dashboard to filter but i can 't even get a simple search working. How do i filter app-name in the csv before fetching the nfs info, for instance with an IN list... app1, app2, app5, etc
... View more