Hi!
Is it possible to pass into lookup's name created by outputlookup command a token or a search value?
Smth like this:
index=foo
| eval week=<here comes some evaluation, e.g. number of week>
| outputlookup dataset_$week$.csv
I've tried to write it differently, but outputlookup eats all sorts of symbols and just creates files with $ ' "
` in its name while I wanted dataset_15.csv
The map command should be able to handle this. For example:
index=* host=sample_host | dedup host | map search="search * | outputlookup $host$.csv"
The map command should be able to handle this. For example:
index=* host=sample_host | dedup host | map search="search * | outputlookup $host$.csv"
Wow! It works, thank you!