I have a lookup table which includes a list of IP addresses (field name = ip). I am trying to compose a search which will display only items from my lookup table with a status indicating whether they were found in the index or not.
For example if my lookup table contains 192.168.1.100, 192.168.1.101 and then the index has events with 192.168.1.100 and 192.168.1.102, my results should be something like this:
192.168.1.100 - ipExists
192.168.1.101 - ipNotExists
Note that values 192.168.102 was not listed since it was not found in the lookup table.
I can get the matching results easy enough but I'm not sure how to get the results that don't match without it including all items in the index, even if they are not found in my lookup table.
This is what I have so far which shows matches, but the non matches include items not in the lookup table. In the end, I just want to have an output containing all the IPs listed in my lookup table with a status indicating that they were found/not found.
eventtype=myindex
| lookup mylookup local=true ip OUTPUT ip as matched
| eval matched=if(isnull(matched), "ipExists", "ipNotExists")
... View more