Why can't I use my lookup command after stats command in my search string

[jcorkey]

I am trying to use stats command to display data organized by My_Field where My_Field is populated by running lookup my_lookup_script username AS user

Here's the example of the search string:

| stats STUFF by My_Field | lookup my_lookup_script username AS user

My problem is that My_Field is not populated for the stats command to use because the lookup command happens after the stats command. I tried simply running the lookup BEFORE the stats command but the lookup needs to run at the end of the search because if it does not then the lookup does not work properly. If the lookup runs before the stats command It gets inconsistent values for user. Seems like the lookup has to be at the end so the whole search can finish running and have the correct data in user for the script to use.

How can I have the lookup run after that stats command to where the stats command can use the My_Field

[DalJeanis]

You are telling us your conclusions rather than your business requirements. Here's a total stab in the dark.

 your search | stats STUFF by user  | lookup my_lookup_script username AS user | stats MORESTUFF  by My_Field

If that is not the strategy that you are looking for, then explain the following things -

1) what is in the raw fields to be aggregated
2) what is the actual field being looked up, and the output fields
3) what happens when you put the lookup before the first stats, and why do you think that is incorrect.

One other thing you can check first - is the capitalization of user field values consistently the same as are in the lookup table? If not, consider using upper() or lower() to make it so.