I have 2 search Queries to get the windows shutdown list from the lookup file but when I run these 2 Queries I am getting different host list for same time period, Can you please suggest the best Query to get the shutdown hosts from the lookup file.
1. index=* host=* sourcetype=XmlWinEventLog* (EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008) join type=inner host [ |inputlookup Windows.csv ] | stats count by host | dedup host
2. index=* sourcetype=XmlWinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 [ | inputlookup Windows.csv | return 1000 host] | stats count by host | where count >1
In this case I will suggest this search,
index=* sourcetype=XmlWinEventLog* (EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008) [| inputlookup Windows.csv | return 1000 host]
| stats count by host
| where count >1
and if I'm right you will have only those host which has events if you remove "| where count >1" from search.
KV