I have a main search and a lookup table
I want to assign field called isCorrect to values from the main search that matches the lookup table
it would look something like this
<main search>
| eval isCorrect = if(<found in lookup> , "true", "false")
however i am not sure how to form the logic for the boolean statement in the if statement
for now my boolean statement looks like
[|inputlookup lookup.csv| fields match]
A subsearch won't work there. You should consult the lookup table for each event and test for correctness. Something like this:
<main search>
| lookup lookup.csv <some field from the event> output <some field from the lookup>
| eval isCorrect = if(isnull(<some field from the lookup>, "false", "true")
A subsearch won't work there. You should consult the lookup table for each event and test for correctness. Something like this:
<main search>
| lookup lookup.csv <some field from the event> output <some field from the lookup>
| eval isCorrect = if(isnull(<some field from the lookup>, "false", "true")
Great it works for me!