Hello, can you use a output lookup table just after creating it? I have this search...
index=indexA sourcetype=mystA | table src | outputlookup new.csv
| search index=indexB sourcetype=mystB [| inputlookup new.csv | rename src as src_ip ]
| table user
| lookup user.csv AS user OUTPUT displayName
When I run this I get no data found, however, when I separate out the outputlookup command and the subsearch and run I get results as expected.
reposted initially as an Answer: reposting as a comment:
My use case is:
I need a count of users by there business units. To do this I do:
output list IPs as seen in blue coat logs
index=indexA sourcetype=mystA | table src | outputlookup new.csv
using this list (new.csv) match on IP to get user name from our authentication data (indexB) to display business unit
| search index=indexB sourcetype=mystB [| inputlookup new.csv | table src | rename src as src_ip ]
| table user
| lookup user.csv uname as user OUTPUT displayName businessUnit
| stats count by businessUnit
My use case is:
I need a count of users by there business units. To do this I do:
output list IPs as seen in blue coat logs
index=indexA sourcetype=mystA | table src | outputlookup new.csv
using this list (new.csv) match on IP to get user name from our authentication data (indexB) to display business unit
| search index=indexB sourcetype=mystB [| inputlookup new.csv | table src | rename src as src_ip ]
| table user
| lookup user.csv uname as user OUTPUT displayName businessUnit
| stats count by businessUnit
I don't think you can do that. What's your use case here?