Hello,
I have a KV file that is auto generated with username using a script running every hour. I want to match the username in the KV file with a different index search. I have written the following query but it is always stuck on "Parsing Job". The index contains a user column. The output should be the username that is common in both user table.
index=abc
| search [| inputlookup Leaver_Lookup.kv | fields "User ID" | rename "User ID" as user | dedup user | table user ]
Is LOOKUP defined?
| inputlookup <lookup-name> where <eval-expression> | ...
Is this search working?
| inputlookup Leaver_Lookup.kv | fields "User ID" | rename "User ID" as user | dedup user | table user
Yes that search works.