When Iam trying to run this search its giving me wrong results .Please correct my search. In my csv is having to coumlmns one is host and other H=YES . Thanks
| metadata type=hosts index=*
| join [| inputlookup watchlist1.csv |search H=YES| rename Host as host]
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host
| sort lastTime
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount
Are you trying to filter the results of the metadata
query to only show hosts from your lookup file that contain YES
in the H
field? If so, give this a shot:
| metadata type=hosts index=*
| search
[| inputlookup watchlist1.csv
|search H="YES"
| rename Host as host
| fields host ]
| stats min(firstTime) as firstTime, max(recentTime) as recentTime, max(lastTime) as lastTime, sum(totalCount) as totalCount by host
| sort lastTime
| convert cTime(firstTime) ctime(recentTime) ctime(lastTime)
| fields host, firstTime, recentTime, lastTime, totalCount
Hi ellitproebstel ,
Thanks :)Search is working can you help me to find the fully qualified name for host when i search its giving me host name in short cut .
Do you have the fully qualified name somewhere in your logs or in a lookup?
logs are having names
In csv better we need to keep host names as below i got results but in more hosts than csv file .
host H
YY* YES
XX* YES
Hi Mate,
As we are getting the duplicate results from the csv table and the results are coming with both normal host name and hostname with FQDNS. How do we resolve this and please suggest.
Example:
host
host.com
Thanks.