Hi everyone,
I'm having a little trouble querying with a CSV and wondered if you could provide assistance.
I have a CSV with a lot of email addresses:
Layout of Emails.csv
Emails
Email1@address.com
Email2@address.com
Email3@address.com
and so forth.
The query I'm using is:
index=index1 sourcetype=MessageTracking | search [|inputlookup Emails.csv | rename Emails as address | fields address ] | table address, directionality
directionality is a field in the sourcetype MessageTracking. Unfortunately I am getting no results out of the query, although there are addresses in that sourcetype and the csv which I've queried and do get results back for.
Any help would be appreciated.
Thanks
Steve
↧