I'm having a really hard time figuring this one out. How can I enrich my search results with an inputlookup?
In this search I can show all hosts that do have a filesystem for a specific process, but don't have that process running:
index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host
I also created an outputlookup (cpu.csv), showing 3 fields: host, cpu-count, and cpu-type.
Now, I would really like to enrich the first search, with the specs from the cpu's, resulting in host (from first search), cpu-count and cpu-type (from inputlookup).
Thank you in advance!
Try this
index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host | lookup cpu.csv host
Assuming cpu.csv is set as lookup table and its scope/permissions have been setup correctly to be accessible here.