I have a two part question about lookup tables:
Q1 - I have a 1 lookup table that has multiple fields. Sometimes the fields could be populated and other times the fields could be empty. For example
col1, col2, col3
d1,d2,d3
,d2,d3
d1,,d3
Can you search a lookup with multiple fields? Is there a way to search the data in a lookup regardless if the field is populated or not?
I tried inputlookup:
mysearch [| inputlookup mytable | fields field1,field2,field3]
This brought 0 events when I am certain that there are events
I also tried added a Flag column that eq true and running a lookup on table:
* | lookup mytable field1 fieldd2 field3 | search Flag=true
This somewhat worked because it brought data that was in field3 but not in the other fields
Q2 - I am populating 2 two different lookups. Each lookup has 2 columns. 1 column is the data that I am searching for and other column is a flag. I want to run a lookup on both tables and if the data in 1 lookup it will show the data in the output. Can you search 2 lookups in 1 search command?
I tried the following:
mysearch | lookup mycsv.csv fields AS field1 | lookup mycsv2.csv fields AS field2 field3| search Flag=true.
Can you search 2 lookups in 1 search command?
... View more