I am currently trying to correlate a field being extracted for user badge to a lookup table I created that include additional user attributes (full name for example) to make data charts more user friendly.
The lookup table includes fields userid and user_fullname. I have extracted userid values in my search but can't find a way to correspond userid with the user_fullname in the lookup table. What would be the best way to go about doing this?
I was able to accomplish this by piping to:
| lookup my_lookup_table userid
Within my search. This took the userid field I extracted from my results using rex and pulled in the related fields from my lookup table for each userid.