Please help, want to do a search based on a table of sever-list and find last update time from a server log. I try to create a table first with 4 server listed, I had one server 2.2.2.2. had result in server log. so I expect the result is 4 rows with 2.2.2.2 had totalcount and date and other is empty/null but showing 4 rows. But the result is the inputlookup and append/appendcols will show 1 row only.
Any method to show 4 rows instead. Can any one had experience on it. Thanks
Using this Searchstring sample
| inputlookup append=true hosts_1.csv | table yumclientip,team,is_expected,totalcount,yumdate | join yumclientip append [ search xxx yyy zzzz | setfields count="0" yumdate="NA" | stats count as totalcount by yumclientip, yumdate | fillnull value="(empty)" "totalcount" "yumdate" | dedup yumclientip sortby +_time ]
csv file hosts)1.csv
##################
yumclientip,team,is_expected
1.1.1.1,teamA,true
2.2.2.2,teamB,true
3.3.3.3,teamC,true
4.4.4.4,teamD,true
Result get (only 2.2.2.2 had data)
########################
yumclientip,team,is_expected,totalcount,yumdate
2.2.2.2,teamA,true,18,2017-07-23
But expect result want 4 rows and not 1 rows only
####################
yumclientip,team,is_expected,totalcount,yumdate
1.1.1.1,teamA,true,empty,empty
2.2.2.2,teamB,true,18,2017-07-23
3.3.3.3,teamC,true,empty,empty
4.4.4.4.teamD,true,empty,empty
... View more