One field in a lookup file referring to other fields in another lookup file.

[thirumalreddyb]

I have a weird situation.

1) I have a sourcetype "transactions" in which it has a field called "account_number".
2) There is a lookup file configured for this sourcetype which gives the "zipcode" of the respective account_numbers.
3) There is another lookup file in which i have "latitude" and "longitude" for the respective zipcodes.

My situation is I need to get latitudes and longitudes for respective "account_numbers" when i search something in sourcetype = "transactions". Please help.

[richgalloway]

You should be able to use the output of one lookup as input to another lookup. Something like 'sourcetype=transactions | lookup foo.csv account_number OUTPUT zipcode | lookup bar.csv zipcode OUTPUT latitude longitude' should do it.