I have a few searches I have added a lookup table to. All of them work, but one. The one below uses metadata and I'm not sure how to make it work with the lookup table. My goal it to find host that have not connected in the last 5 min.
| metadata [| inputlookup Meeting_Rooms | fields host] | eval age = now()-lastTime | where age > 50 | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time"
This is not getting any results. If I replace "[| inputlookup Meeting_Rooms | fields host]" with "type=hosts" it works fine, but will show all host. Any ideas how I can make this work with my lookup table?
↧