@joydeep741,
Try below query.
I have just provided an example.
You can consider only this part for your logic | eval tableval2=if(tableval1=lookupval1,lookupval2,tableval2)
I believe you are well aware of how to use lookup and how lookup logic works.
| makeresults
| eval tableval1=mvappend("1","2","3","4","5","6")
| eval tableval2 =mvappend("a","b","c","d","e","f")
| mvexpand tableval1
| mvexpand tableval2
| table tableval1 tableval2
| appendcols [| makeresults
| eval lookupval1 =mvappend("1","3","6")
| eval lookupval2=mvappend("1000","1111","2222")
| mvexpand lookupval1
| mvexpand lookupval2
| table lookupval1 lookupval2
]
| eval tableval2=if(tableval1=lookupval1,lookupval2,tableval2)
| table *
Thanks..
... View more