I am trying to use stats command to display data organized by My_Field
where My_Field
is populated by running lookup my_lookup_script username AS user
Here's the example of the search string:
| stats STUFF by My_Field | lookup my_lookup_script username AS user
My problem is that My_Field
is not populated for the stats command to use because the lookup command happens after the stats command. I tried simply running the lookup BEFORE the stats command but the lookup needs to run at the end of the search because if it does not then the lookup does not work properly. If the lookup runs before the stats command It gets inconsistent values for user
. Seems like the lookup has to be at the end so the whole search can finish running and have the correct data in user
for the script to use.
How can I have the lookup run after that stats command to where the stats command can use the My_Field
You are telling us your conclusions rather than your business requirements. Here's a total stab in the dark.
your search | stats STUFF by user | lookup my_lookup_script username AS user | stats MORESTUFF by My_Field
If that is not the strategy that you are looking for, then explain the following things -
1) what is in the raw fields to be aggregated
2) what is the actual field being looked up, and the output fields
3) what happens when you put the lookup before the first stats, and why do you think that is incorrect.
One other thing you can check first - is the capitalization of user field values consistently the same as are in the lookup table? If not, consider using upper()
or lower()
to make it so.