I have a listed lookup table xxx .
When I run the below search. it shows no results.
inputlookup xxxx|fields USERNAME|search index=main sourcetype=oracle_aud user=CONN| stats count(user) by source,user
What can be the issue ?
Have check that there is no issue with the lookup table xxx |inputlookup xxxx.
Anyone can provide some good advise?
Thank it works for the one
It is how to use sub search.
index=main sourcetype=oracle_aud user=CONN [inputlookup xxxx|fields USERNAME]
⇒index=main sourcetype=oracle_aud user=CONN (USERNAME=AAA OR USERNAME=BBB OR ・・・)
index=main sourcetype=oracle_aud user=CONN [inputlookup xxxx|fields USERNAME |rename USERNAME as query]
⇒index=main sourcetype=oracle_aud user=CONN (AAA OR BBB OR ・・・)
What's the purpose of using lookup in the query? Are you fetching metadata from lookup? What's the column through which you are doing join?