Hi Experts
Actually I am searching on one index, where Userid is with multiple fields like user,userids,useridvalue,user_id etc., on the events ( since it is from multiple source types). And I want to check this ids against one input lookup that contains all the Userid (only one column in lookup) and table it.
But it is not working for me. Since I am new to this platform could someone assist me please.
index= "user_prod" [ input lookup Userid.csv |rename user as Userid | rename userids as Userid | rename useridvalue as Userid | rename user_id as Userid | fields Userid ] | table Userid
Please note: inputlookup filename name and inside column name are similar - Userid
Thanks in advance!
One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:
index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid
One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:
index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid
Thanks jpolvino !
It works now!