I'm trying to join hosts from a .csv file to the results of this metadata search:
|metadata type=hosts | eval time_diff = now() - lastTime
The .csv file will have some hosts that don't exist in the metadata results but I need to have them show in the final results.
I was thinking a subsearch would work but it fails to match up all the records. I only get about 20 matching records but it does show all records from the .csv.
|inputlookup myfile.csv | fields host | join type=outer host [|metadata type=hosts | eval time_diff = now() - lastTime| table *]
Any suggestions???
↧