I want to limit the search that matches the "dest" values which are a part of lookup
Currently I am getting all events 😐
Lookup: host.csv lookup columns: aa bb
I tried something like below:
|tstats summariesonly=f count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (condition)[|inputlookup host.csv |fields + aa |rename aa as Processes.dest] by Processes.dest
Any help would be appreciated!
Thanks
I would check the inspector as it should give you some hints on what the final search that splunk is using after the sub search. Check remoteSearch
Please tell us more about what you're trying to do. What results do you want?
Have you looked at the manual for the inputlookup command? It accepts a where option that limits the matches. See https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Inputlookup#Syntax