Hi, trying to use two lookup tables in one search. Is this possible?
Basically I have a list of email domains in one lookup table, and a list of users in another. I want to produce a report (with my email data that has both user/email domain fields) for these certain users sending mail to these certain domains. Is there any specific syntax I need to use? Won't see to work.
source=emailRecords, lookup tables are emailDomains.csv and leavers.csv
One thing to note is that I'm using wildcards in my emailDomains.csv....so the field "ToAddress" can look like
*gmail.com,
*yahoo.com, etc.
I believe something like this should work. For wildcard to work on the lookup table, you need to create lookup definitions and set it to work with wildcard (see this)
source=emailRecords | lookup ludef_emailDomains emailDomain as ToAddress | lookup ludef leavers.csv userName as <<userName field in your logs>>
Updated field names as per your data.
I believe something like this should work. For wildcard to work on the lookup table, you need to create lookup definitions and set it to work with wildcard (see this)
source=emailRecords | lookup ludef_emailDomains emailDomain as ToAddress | lookup ludef leavers.csv userName as <<userName field in your logs>>
Updated field names as per your data.
You might want to add some sample log entries,format of your lookup files etc. Adding more details will help you get more accurate suggestions.
This is close...but I'm looking to show only these fields. If I use inputlookup, this works. But I need (if toAddress, bccAddress, or ccAddress) is in the lookup table, return the results. I can do this for one field (inputlookup Emaildomains | fields + toAddress)...but I want it to be any of the three fields