Hi ,
I need to extract the host list which are belonging to certain applications ( Listed in my Lookup table )
Need to find which hosts are getting connected to Deployment server and after that need to pick out the hosts which are present in the lookup table. I have used join in my query. It works fine.
index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}\d+(?P<remote_host>.+?)" | rex "(?i).com(?P<remote_host>.+?)_" | dedup remote_host |rename remote_host as hostname| join hostname[|inputlookup applist] | stats distinct_count(hostname)
Any alternate idea to this?
Will join consume more time to run?
Thanks in advance
Yes join consume more time to run. I think you will be interested by the link bellow:
Stephane,,
Many Thanks and could you please explain a bit to compare events with lookup table as in my scenario.
ok. in your case that is what you could do to avoid join:
index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}d+(?P<remote_host>.+?)" | rex "(?i).com(?P<remote_host>.+?)_" | dedup remote_host |rename remote_host as hostname| lookup applist.csv hostname| stats distinct_count(hostname)