Hi all,
Can we use |append [|inputlookup tmp.csv]
in a post process search?
Here is the code:
<table>
<search id="test">
<query>|stats count</query>
</search>
</table>
<table>
<search base="test">
<query>|append [|inputlookup tmp.csv|eval count="tmp"]</query>
</search>
</table>
Two tables will show the same result. Click the "open in search" button and jump to search page, the result can contain the csv file.
If inside append is [|stats count|eval count="tmp"]
, the table can show both count=0 and count=tmp.
Is it a bug, the design of post process search, or did I type something wrong? Thanks.
AFAIK, postprocess
only works on the data returned from base search. So, no, you cannot do an inputlookup
AFAIK, postprocess
only works on the data returned from base search. So, no, you cannot do an inputlookup
Thanks. Could you please post your answer so that I could click the accept button?