When I search for this query it shows wrong results ?
|metadata type=hosts index=* |lookup domain.csv host output domain datacenter host IP |search domain=Y|eval age=(now()-recentTime)|convert ctime(*Time)| append[ |inputlookup domain.csv ] | dedup host | fields host IP domain datacenter lastTime age totalCount| sort lastTime
When I serach for this query shows full results ?
host=*wdc* |stats count by host
Any help .
↧