I have a lookup file called us_customers.csv that contains a single field: customer .
I would like to filter the results of my query to the customers in the lookup CSV file.
This query works for me, I see exactly the hosts that belong to the customers:
[ | inputlookup us_customers.csv ] | stats count by host
So I made a macro:
[us_customers]
definition = search [ | inputlookup us_customers.csv ]
And now querying using it:
`us_customers` | stats count by host
I see only a partial result set.
Can anyone explain why this doesn't work?
Thanks.
... View more