Hi !
I have this search:
| makeresults
| eval customField="$Soc3$" , soc3dField="$multi$"
| table customField soc3dField
| makemv soc3dField delim=","
| mvexpand soc3dField
| append [
| inputlookup append=t $Lookup$
| where soc3dField != "$multi$"] ]
$multi$ - could contain multiple values that I get from multiselect
The table I get is with duplicate rows:
What I'm trying to do is to take all the values in the $multi$ (contain the soc3dField) ---> update the customField in the lookup
As you can see below, I've tried the same search with no tokens and It worked good!
| makeresults
| eval customField="f43256" , soc3dField="bytesIn,bytesOut"
| table customField soc3dField
| makemv soc3dField delim=","
| mvexpand soc3dField
| append
[| inputlookup append=f Test.csv
| where soc3dField != "bytesIn" AND soc3dField != "bytesOut"]
Thank you !!
... View more