For example, I have lookup xyz.csv with two fields, A and B.
I want to search for the value of A field. If any match occurs, then the value of the A and B field should be displayed with other information, which is available in raw logs.
Yes it is possible to have lookups that use the field values from other lookups. Lookups run in sequence from their lexogrphical order. For example, the following will work:
props.conf
[my_sourcetype]
LOOKUP-a = lookup-a host OUTPUTNEW fielda fieldb
LOOKUP-b = lookup-b fielda OUTPUTNEW fieldc
Good luck
Like this:
index=YouShouldAlwaysSepcifyAnIndex AND sourcetype=AndSourcetypeToo AND [|inputlookup xyz.csv | table A]
| lookup xyz.csv A OUTPUT B
Yes it is possible to have lookups that use the field values from other lookups. Lookups run in sequence from their lexogrphical order. For example, the following will work:
props.conf
[my_sourcetype]
LOOKUP-a = lookup-a host OUTPUTNEW fielda fieldb
LOOKUP-b = lookup-b fielda OUTPUTNEW fieldc
Good luck
As this is still a top result for this issue, I'd like to add:
In general, it works.
But - if a lookup is larger than the max_memtable_size
in limits.conf (default: 10 MB), it will be indexed to disk. This seems to result in it being applied later - so if the lookup a
in the above example is too big, this won't work anymore.
Raising the limit will fix the issue.
Thanks a ton to @starcher for pointing this out to me!
the auto lookup feature requires it to be in ram. So if over max_memtable_size it isn't. Normal lookup command in SPL will work. just not "autolookup" in props.
So far I can not exactly confirm this. My "not in RAM" auto lookup works, but it seems to be applied AFTER the "in RAM" lookups. In my case, the latter depends on a field from the former, and therefore it fails.
Wow that's interesting and something I didn't know either. Thanks for sharing.
My search is sub search.
For ex.
index=* [|inputlookup xyz.csv | fields A B | rename A as search| format ] | stats count by _raw A B