Hi
I am trying to find an ip from first query and then search that ip if exists in another csv file and show the count of only those ips
| inputlookup asset_list.csv
| search "Infrastrucure Name"="xyz" | eval main_ip=IP [| inputlookup ip_exist.csv | eval test=if(searchmatch("IP=$main_ip$"), "yes", "no") | table IP test | where test="yes" ]
But i am getting error in the eval function.
please help.
@surekhasplunk,
Try
| inputlookup asset_list.csv |eval source="asset"
| search "Infrastrucure Name"="xyz" |append [| inputlookup ip_exist.csv|eval source="exist" ]
| stats count,values(source) as source by IP|where mvcount(source) > 1
If you have different field names for IP in the csv, rename one of them
If you have unique IPs in both files, stats ccount by IP|where count >1
also should work