Hi Team,
Need your assistant for below
We have created new csv lookup and we are using the below query but we are getting all the data from the index & sourcetype . we need to get the events only for the hosts which mentioned on the lookup is the requirement
Lookup name : Palo_devices.csv, used only one column called Hostname
index=security host=abc sourcetype = Palo
|lookup Palo_devices.CSV Hostname OUTPUT Hostname
Regards,
Nagalakshmi
Hi @Nagalakshmi ,
you can use your search only if in the main search you have the field youused as key (in your case "Hostname"), have you this field in the main search?
Anyway, if you want to filter the results of a search for the results of a lookup, you have to use a subsearch like the following, putting attention that the field name in main and sub search is the same.
So if in the lookup ho have a column called Hostname and in the main search there's a field called Hostname, you can run something like this:
index=security host=abc sourcetype = Palo [ | inputlookup Palo_devices.CSV | fields Hostname ]
| ...
Ciao.
Giuseppe
Hi @gcusello ,
Yes, Hostname field is already exists in the event. Thank you for quick response! Mentioned query is a perfect solution for this issue.
Regards,
Nagalakshmi A
Hi @Nagalakshmi ,
you can use your search only if in the main search you have the field youused as key (in your case "Hostname"), have you this field in the main search?
Anyway, if you want to filter the results of a search for the results of a lookup, you have to use a subsearch like the following, putting attention that the field name in main and sub search is the same.
So if in the lookup ho have a column called Hostname and in the main search there's a field called Hostname, you can run something like this:
index=security host=abc sourcetype = Palo [ | inputlookup Palo_devices.CSV | fields Hostname ]
| ...
Ciao.
Giuseppe