Why am I not getting expected results using inputlookup with a time chart?

[nmohammed]

I have the following search which displays the table on calls based on their time range.

sourcetype=elogs clientid=abc |bucket _time span=5m | chart  count(eval(exec_time_ms <300)) AS "A (<300ms)", count(eval(exec_time_ms >300 AND exec_time_ms <600)) AS "B (>300ms <600ms)", count(eval(exec_time_ms >600 AND exec_time_ms <1000)) AS "C (>600ms <1000ms)", count(eval(exec_time_ms >1000 AND exec_time_ms <3000)) AS "D (>1000ms <3000ms)", count(eval(exec_time_ms >3000)) AS "E (>3000ms)"

The above search works fine, but now we want to monitor a selected list of calls and measure their response times based on the buckets. I have read the inputlookup command and tried using it, but not able to get any results.

Our new search would be :

sourcetype=elogs |inputlookup heavy_calls.csv |bucket _time span=5m | chart  count(eval(exec_time_ms <300)) AS "A (<300ms)", count(eval(exec_time_ms >300 AND exec_time_ms <600)) AS "B (>300ms <600ms)", count(eval(exec_time_ms >600 AND exec_time_ms <1000)) AS "C (>600ms <1000ms)", count(eval(exec_time_ms >1000 AND exec_time_ms <3000)) AS "D (>1000ms <3000ms)", count(eval(exec_time_ms >3000)) AS "E (>3000ms)"

the heavy_calls.csv has the following data (there are about 10 calls in the csv) :

call,heavy
Call.a,1
Call.b,1

What we want to see

calls      A   B   C   D   E
Call.a     1   2   5   1   0
Call.b     5   4   2   1   4

Thanks

[woodcock · Accepted solution]

Like this:

sourcetype=elogs [|inputlookup heavy_calls.csv | fields call] | chart count(eval(exec_time_ms <300)) AS "A (<300ms)", count(eval(exec_time_ms >300 AND exec_time_ms <600)) AS "B (>300ms <600ms)", count(eval(exec_time_ms >600 AND exec_time_ms <1000)) AS "C (>600ms <1000ms)", count(eval(exec_time_ms >1000 AND exec_time_ms <3000)) AS "D (>1000ms <3000ms)", count(eval(exec_time_ms >3000)) AS "E (>3000ms)" BY call | rename call As calls

[nmohammed]

Awesome..!! thanks Somuch Woodcock. This worked.

[diogofgm]

Can you post some sample data? How do you relate the data with the csv?